CVE-2026-114519 Roskus CVE debrief

Who should care

Defenders responsible for managing user accounts and ensuring secure access controls in Prospero Flow CRM systems should assess exposure and prioritize remediation. This includes administrators, security teams, and IT personnel managing CRM systems.

Why it matters

CVE-2026-114519 is a high-severity vulnerability in Prospero Flow CRM that allows basic role users to read and delete other user accounts due to missing authorization checks in the user API. Defenders should prioritize verifying and remediating this vulnerability, especially in systems where user account management is critical.

• Potential unauthorized access to sensitive user data.
• Possible deletion of user accounts, which could lead to data loss and disruption of service.
• Exposure of user accounts with higher privileges, increasing the risk of privilege escalation.
• Need for verification of affected versions and implementation of authorization checks.

Technical summary

The vulnerability in Prospero Flow CRM involves missing authorization checks in the user API, specifically in the routes GET /api/user/{id} and DELETE /api/user/{id}. This allows a basic role user to read accounts of other users within the same company, including those with higher privileges, and delete them in versions 3.5.0 and later. The issue arises because the auth:api middleware only checks for a valid JSON Web Token and does not verify permissions, policies, or roles.

Defensive priority

Defenders should prioritize verifying and remediating this vulnerability, especially in systems where user account management is critical.

Recommended defensive actions

• Verify the version of Prospero Flow CRM and check if it is within the affected range (2.0.0 to 5.26.0).
• Implement authorization checks for user API endpoints to prevent unauthorized access.
• Restrict permissions for basic role users to prevent them from reading or deleting other user accounts.
• Monitor user account management activities for suspicious behavior.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The vulnerability is confirmed in Prospero Flow CRM versions from 2.0.0 before 5.26.0. Evidence from official sources and vendor reports indicates that the issue involves missing authorization checks in the user API, allowing basic role users to read and delete other accounts.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.