CVE-2026-19539 Roskus CVE debrief

Who should care

Organizations using Roskus Prospero Flow CRM before version 5.4.9 should be aware of this vulnerability and take necessary actions to protect their systems. The vulnerability impacts organizations that use the affected CRM versions, as it could lead to unauthorized access and manipulation of sensitive ticket information. Security teams, vulnerability management teams, and operators of the affected systems should prioritize patching and mitigation efforts to prevent exploitation.

Technical summary

The ticket management component in Roskus Prospero Flow CRM before 5.4.9 is vulnerable to an authorization bypass through a user-controlled key. This allows authenticated users of any company to read the full content of tickets belonging to another company, hijack another company's tickets by reassigning their company_id, and delete another company's tickets without proper authorization. The vulnerability arises from the lack of proper company ID validation in ticket management operations, which enables unauthorized access and manipulation of sensitive ticket information.

Defensive priority

Authenticated users of any company can read, hijack, and delete tickets of another company due to insufficient authorization checks in Roskus Prospero Flow CRM before 5.4.9.

Recommended defensive actions

• Verify the version of Roskus Prospero Flow CRM and upgrade to 5.4.9 or later if necessary.
• Restrict access to sensitive ticket information and ensure proper authorization checks are in place.
• Monitor for suspicious activity related to ticket management in the CRM system.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE-2026-19539 issue allows authenticated users to bypass authorization and read, hijack, or delete tickets from another company in Roskus Prospero Flow CRM before version 5.4.9. This is due to the lack of proper company ID validation in ticket management operations. The vulnerability impacts organizations using the affected CRM versions, as it could lead to unauthorized access and manipulation of sensitive ticket information. To verify the vulnerability, defenders should review the CRM system configurations, check for any suspicious activity related to ticket management, and ensure that proper authorization checks are in place.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.