CVE-2026-59236: Prospero Flow CRM Auth Bypass Vulnerability

CVE-2026-59236 Overview

CVE-2026-59236 is an Authorization Bypass Through User-Controlled Key vulnerability [CWE-639] in Roskus Prospero Flow CRM before version 5.14.0. The flaw resides in the Excel import handlers CustomerImport, LeadImport, and ProductImport. Any authenticated user, regardless of role or company, can upload a spreadsheet whose company_id column references another tenant. The endpoint POST /customer/import/excel/save maps company_id directly from the uploaded file and skips verification against the authenticated user's tenant. As a result, an attacker can inject customer, lead, and product records into a victim company's tenant.

Critical Impact
Authenticated attackers can create arbitrary customer, lead, and product records inside another company's tenant, breaking multi-tenant isolation in Prospero Flow CRM.

Affected Products

Roskus Prospero Flow CRM versions prior to 5.14.0
Excel import handlers: CustomerImport, LeadImport, ProductImport
Endpoint: POST /customer/import/excel/save

Discovery Timeline

2026-07-15 - CVE-2026-59236 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-59236

Vulnerability Analysis

Prospero Flow CRM is a multi-tenant CRM where records are segregated by a company_id field. Each authenticated user belongs to exactly one company and should only manipulate records within that tenant. The Excel import feature accepts spreadsheets containing rows destined for bulk creation of customers, leads, or products. Instead of enforcing the authenticated user's company_id on the server, the import handlers trust the company_id column supplied inside the uploaded file. This trust boundary failure lets any authenticated user write records into arbitrary tenants.

Root Cause

The root cause is Authorization Bypass Through User-Controlled Key [CWE-639]. The handlers CustomerImport, LeadImport, and ProductImport treat the company_id value from the parsed spreadsheet as an authoritative tenant identifier. No server-side comparison is performed between the file-supplied company_id and the session-bound tenant of the requesting user. The fix in release v5.14.0 enforces tenant scoping by overriding or validating the company_id on the server side. See the GitHub commit bdd6c977 for the patch.

Attack Vector

An authenticated attacker with an account of any role in any tenant crafts an Excel file whose company_id column contains the numeric identifier of a victim tenant. The attacker submits the file to POST /customer/import/excel/save (and equivalent endpoints for lead and product imports). The server parses the workbook, maps each row directly to a database insert, and persists the new records under the victim's tenant. The attacker can pollute the victim's customer, lead, or product data, plant social-engineering pretexts, or disrupt sales workflows. See the Secur0 advisory for further technical analysis.

No verified proof-of-concept code is publicly available. The vulnerability mechanism is described above in prose based on the vendor commit and advisory.

Detection Methods for CVE-2026-59236

Indicators of Compromise

Records in customers, leads, or products tables whose company_id does not match the company_id of the created_by user account.
Web server access log entries showing POST /customer/import/excel/save from user accounts that historically do not perform bulk imports.
Sudden appearance of unfamiliar customer, lead, or product entries reported by tenant administrators.

Detection Strategies

Run a database audit query that joins imported records with the user table to flag any row whose company_id differs from the importing user's company_id.
Enable application-layer logging on the three import handlers and record both the authenticated user's tenant and the tenant value parsed from each Excel row.
Alert on any import request where the parsed company_id value does not equal the session company_id.

Monitoring Recommendations

Forward Prospero Flow CRM application logs and web access logs to a centralized SIEM for correlation across tenants.
Track the ratio of import requests to created records per user, and flag accounts that generate records in tenants other than their own.
Monitor upstream reverse proxy logs for POST requests to /customer/import/excel/save, /lead/import/excel/save, and /product/import/excel/save originating from low-privilege accounts.

How to Mitigate CVE-2026-59236

Immediate Actions Required

Upgrade Prospero Flow CRM to version 5.14.0 or later, which contains the fix in commit bdd6c977.
Audit existing customer, lead, and product records for cross-tenant company_id mismatches and remove or quarantine unauthorized entries.
Restrict access to the Excel import endpoints to a minimal set of trusted roles until the upgrade is completed.

Patch Information

The vendor released Prospero Flow CRM v5.14.0, which addresses CVE-2026-59236. The corresponding fix is available in GitHub commit bdd6c977. The patch enforces server-side tenant scoping so that company_id is derived from the authenticated session rather than the uploaded spreadsheet.

Workarounds

Temporarily disable the Excel import routes at the web server or reverse proxy level until the upgrade is applied.
Add a middleware or request filter that rejects any import request whose parsed company_id value does not match the authenticated user's tenant.
Restrict the Excel import feature to administrator roles only, reducing the pool of accounts that can exercise the vulnerable code path.

bash

# Example NGINX configuration to block Excel import endpoints during remediation
location ~ ^/(customer|lead|product)/import/excel/save$ {
    return 403;
}