CVE-2026-19539: Prospero Flow CRM Auth Bypass Vulnerability

CVE-2026-19539 Overview

CVE-2026-19539 is an Insecure Direct Object Reference (IDOR) vulnerability in the ticket management component of Roskus Prospero Flow CRM before version 5.4.9. The flaw allows any authenticated user of any tenant company to read, hijack, or delete tickets belonging to other companies by supplying the target ticket's numeric identifier. The root cause is missing authorization enforcement [CWE-862] in the read, update, and delete controller paths.

Critical Impact
Authenticated cross-tenant attackers can read confidential ticket content (titles, descriptions, attachments), reassign tickets to their own company_id, and delete any other tenant's tickets without authorization checks.

Affected Products

Roskus Prospero Flow CRM versions prior to 5.4.9
Ticket management component (TicketDeleteController, TicketUpdateController)
Multi-tenant deployments sharing a single database

Discovery Timeline

2026-08-11 - CVE-2026-19539 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-19539

Vulnerability Analysis

Prospero Flow CRM is a multi-tenant Laravel application where each user belongs to a company_id. The ticket subsystem exposes numeric identifiers in URLs but fails to verify that the ticket being accessed belongs to the caller's tenant. As a result, an authenticated user in tenant A can iterate ticket IDs and access records owned by tenant B.

Three operations are affected. The read and update paths call Ticket::find($id) without scoping the query to Auth::user()->company_id. The delete controller compounds the problem by type-hinting the generic Illuminate\Http\Request rather than the application's TicketDeleteRequest, which would otherwise enforce the delete permission via Laravel's form-request authorization.

Exploitation requires only a valid low-privileged account. The attacker gains confidentiality impact through disclosure of ticket titles, descriptions, and attachments, and integrity impact by reassigning company_id to hijack tickets or by deleting records outright.

Root Cause

The vulnerability is classified as [CWE-862] Missing Authorization. Database queries retrieve records by primary key alone, and the delete route bypasses form-request authorization by accepting a generic request object. Tenant isolation is not enforced at the query layer.

Attack Vector

The attack is executed over the network by any authenticated user of any tenant. The attacker sends HTTP requests to the ticket read, update, or delete endpoints supplying a numeric id belonging to another tenant. No user interaction from the victim is required.

php

// Vulnerable delete controller (before patch)
namespace App\Http\Controllers\Ticket;

use App\Http\Controllers\MainController;
use App\Models\Ticket;
use Illuminate\Http\Request;

class TicketDeleteController extends MainController
{
    public function delete(Request $request, int $id)
    {
        $ticket = Ticket::find($id);
        $ticket->delete();

        return redirect('/ticket');
    }
}

Source: GitHub Commit Summary

Detection Methods for CVE-2026-19539

Indicators of Compromise

Application logs showing a single authenticated user accessing ticket IDs that do not belong to their company_id.
HTTP requests to /ticket/{id}, /ticket/update/{id}, or /ticket/delete/{id} with sequential or enumerated numeric identifiers.
Unexpected changes to the company_id column on tickets table rows.
Ticket deletion events without a corresponding authorized workflow entry.

Detection Strategies

Correlate the authenticated user's company_id against the company_id of the accessed ticket in web server or application logs.
Alert on high-volume enumeration of the ticket ID space from a single session.
Monitor database audit logs for UPDATE tickets SET company_id = ... statements originating from unexpected sources.

Monitoring Recommendations

Enable Laravel query logging on the ticket routes and forward logs to a centralized SIEM for cross-tenant correlation.
Baseline normal per-user ticket access volume and alert on deviations.
Track version and commit hash of the deployed Prospero Flow CRM instance to confirm patch state.

How to Mitigate CVE-2026-19539

Immediate Actions Required

Upgrade Roskus Prospero Flow CRM to version 5.4.9 or later (fix included through release v5.5.3).
Audit the tickets table for anomalous company_id reassignments since deployment.
Rotate credentials for any tenant whose ticket data may have been exposed.
Restrict access to the CRM at the network layer until the patch is applied.

Patch Information

The fix is delivered in commit b2b6ffd and shipped in release v5.5.3. The patched controllers scope queries to the authenticated user's company_id and enforce the TicketDeleteRequest form request on the delete route. See the GitHub Release Notes and the Secur0 CVE-2026-19539 Analysis for full details.

php

// Patched update controller
public function update(Request $request, int $id)
{
    $user = new User;
    $ticket = Ticket::where('id', $id)
        ->where('company_id', Auth::user()->company_id)
        ->firstOrFail();
    // ...
}

// Patched delete controller
public function delete(TicketDeleteRequest $request, int $id)
{
    $ticket = Ticket::where('id', $id)
        ->where('company_id', Auth::user()->company_id)
        ->firstOrFail();
    $ticket->delete();

    return redirect('/ticket');
}