CVE-2026-59236 Roskus CVE debrief

Who should care

Defenders of Roskus Prospero Flow CRM installations should assess exposure and prioritize verification and remediation to prevent potential unauthorized record creation and data integrity issues. This includes reviewing current version and exposure to the vulnerability, and taking steps to verify and upgrade to version 5.14.0 or later.

Why it matters

CVE-2026-59236 is an authorization bypass vulnerability in Roskus Prospero Flow CRM Excel import feature, allowing cross-tenant record injection. Defenders should prioritize verification and remediation to prevent potential unauthorized record creation and data integrity issues.

• Potential unauthorized creation of customer, lead, and product records in another company's tenant
• Possible data integrity issues due to unauthorized record injection
• Need for verification of current version and exposure to the vulnerability
• Potential impact on data confidentiality and integrity

Technical summary

The Excel import handlers (CustomerImport, LeadImport, ProductImport) in Roskus Prospero Flow CRM before 5.14.0 allow a remote, authenticated user of any role or company to create customer, lead, and product records inside another company's tenant via a spreadsheet whose company_id column points to the victim tenant, uploaded to POST /customer/import/excel/save. This is caused by the handlers mapping company_id directly from the file without checking if it matches the authenticated user's company, leading to potential unauthorized record creation and data integrity issues.

Defensive priority

Defenders should prioritize verifying and upgrading to version 5.14.0 or later, and restrict access to the Excel import feature.

Recommended defensive actions

• Verify and upgrade to version 5.14.0 or later
• Restrict access to the Excel import feature
• Monitor for suspicious activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is caused by the Excel import handlers (CustomerImport, LeadImport, ProductImport) mapping company_id directly from the file without checking if it matches the authenticated user's company.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.