Vulnerability Description
Authorization Bypass Through User-Controlled Key (CWE-639) in the Order and OrderItem REST API controllers in Roskus Prospero Flow CRM before 5.5.3 allows a remote, authenticated user to read, modify, and delete orders and order items belonging to any other company (tenant) via a sequential numeric {id} supplied to GET /api/order/{id}, PUT /api/order/{id}, GET /api/order-item/{id}, PUT /api/order-item/{id}, or DELETE /api/order-item/{id}, because the controllers resolve records with Order::find($id) / Item::find($id) without scoping by the authenticated user's company.
Related Weaknesses (CWE)
References
- https://github.com/Roskus/prospero-flow-crm/commit/9a859c4de3d49674916773d346c60
- https://github.com/Roskus/prospero-flow-crm/releases/tag/v5.5.3
- https://secur0.com/en/cna/cve-list/cve-2026-59237-idor-in-prospero-flow-crm-orde
FAQ
What is CVE-2026-59237?
CVE-2026-59237 is a documented vulnerability. Authorization Bypass Through User-Controlled Key (CWE-639) in the Order and OrderItem REST API controllers in Roskus Prospero Flow CRM before 5.5.3 allows a remote, authenticated user to read, modify,...
How severe is CVE-2026-59237?
CVSS scoring is not yet available for CVE-2026-59237. Check NVD for updates.
Is there a patch for CVE-2026-59237?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.