# Roskus Prospero Flow CRM.

Every CVE that names Roskus Prospero Flow CRM among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [Missing authorization in the Prospero Flow CRM user API allows a basic role user to read and delete other accounts](https://agentprime.io/advisories/CVE-2026-114519.md)
  `CVE-2026-114519` · CVE record: Roskus Prospero Flow CRM · CVSS 8.6 High · Not analysed yet · Published 22 Oct 2026 · Tags: Broken access control
- [CSRF in Prospero Flow CRM order confirmation allows unauthorized order state changes](https://agentprime.io/advisories/CVE-2026-82911.md)
  `CVE-2026-82911` · CVE record: Roskus Prospero Flow CRM · CVSS 5.1 Medium · Not analysed yet · Published 4 Sept 2026 · Tags: Cross-site request forgery (CSRF)
- [Unrestricted upload of file with dangerous type in Prospero Flow CRM product photo allows stored cross-site scripting](https://agentprime.io/advisories/CVE-2026-81931.md)
  `CVE-2026-81931` · CVE record: Roskus Prospero Flow CRM · CVSS 4.8 Medium · Not analysed yet · Published 27 Aug 2026 · Tags: Unrestricted file upload
- [IDOR and missing authorization in Prospero Flow CRM supplier API allows cross-tenant read and modification](https://agentprime.io/advisories/CVE-2026-78365.md)
  `CVE-2026-78365` · CVE record: Roskus Prospero Flow CRM · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Aug 2026 · Tags: Broken access control
- [Unrestricted upload of file with dangerous type in Prospero Flow CRM allows stored cross-site scripting via SVG](https://agentprime.io/advisories/CVE-2026-78337.md)
  `CVE-2026-78337` · CVE record: Roskus Prospero Flow CRM · CVSS 4.8 Medium · Not analysed yet · Published 24 Aug 2026 · Tags: Unrestricted file upload
- [Unvalidated bank account and card foreign keys in the Prospero Flow CRM transaction save endpoint allow cross-tenant disclosure of banking identifiers](https://agentprime.io/advisories/CVE-2026-77780.md)
  `CVE-2026-77780` · CVE record: Roskus Prospero Flow CRM · CVSS 5.3 Medium · Not analysed yet · Published 21 Aug 2026 · Tags: Broken access control
- [IDOR and missing authorization in the Prospero Flow CRM transaction API allow cross-tenant reading of financial records](https://agentprime.io/advisories/CVE-2026-77759.md)
  `CVE-2026-77759` · CVE record: Roskus Prospero Flow CRM · CVSS 8.7 High · Not analysed yet · Published 21 Aug 2026 · Tags: Broken access control
- [Use of hard-coded credentials in Prospero Flow CRM employee onboarding](https://agentprime.io/advisories/CVE-2026-19871.md)
  `CVE-2026-19871` · CVE record: Roskus Prospero Flow CRM · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Aug 2026 · Tags: Hard-coded credentials
- [IDOR in Prospero Flow CRM allows cross-tenant payroll disclosure and creation](https://agentprime.io/advisories/CVE-2026-19870.md)
  `CVE-2026-19870` · CVE record: Roskus Prospero Flow CRM · CVSS 8.6 High · Not analysed yet · Published 14 Aug 2026 · Tags: Broken access control
- [IDOR in Prospero Flow CRM allows cross-tenant product disclosure and hijacking](https://agentprime.io/advisories/CVE-2026-19734.md)
  `CVE-2026-19734` · CVE record: Roskus Prospero Flow CRM · CVSS 8.6 High · Not analysed yet · Published 13 Aug 2026 · Tags: Broken access control
- [IDOR in Prospero Flow CRM allows cross-tenant ticket read, hijacking, and deletion](https://agentprime.io/advisories/CVE-2026-19539.md)
  `CVE-2026-19539` · CVE record: Roskus Prospero Flow CRM · CVSS 8.6 High · Not analysed yet · Published 11 Aug 2026 · Tags: Broken access control
- [Authorization Bypass Through User-Controlled Key in Prospero Flow CRM contact save and vCard export](https://agentprime.io/advisories/CVE-2026-19433.md)
  `CVE-2026-19433` · CVE record: Roskus Prospero Flow CRM · CVSS 8.6 High · Not analysed yet · Published 10 Aug 2026 · Tags: Broken access control
- [Missing Authorization in Prospero Flow CRM permission save endpoint allows privilege escalation](https://agentprime.io/advisories/CVE-2026-59233.md)
  `CVE-2026-59233` · CVE record: Roskus Prospero Flow CRM · CVSS 8.7 High · Not analysed yet · Published 10 Aug 2026 · Tags: Broken access control
- [Stored Cross-site Scripting in Prospero Flow CRM lead name field](https://agentprime.io/advisories/CVE-2026-59232.md)
  `CVE-2026-59232` · CVE record: Roskus Prospero Flow CRM · CVSS 5.3 Medium · Not analysed yet · Published 31 Jul 2026 · Tags: Cross-site scripting (XSS)
- [IDOR in Prospero Flow CRM allows deletion of other users' notifications](https://agentprime.io/advisories/CVE-2026-59240.md)
  `CVE-2026-59240` · CVE record: Roskus Prospero Flow CRM · CVSS 6.9 Medium · Not analysed yet · Published 27 Jul 2026 · Tags: Broken access control
- [Stored XSS in Prospero Flow CRM email body allows administrator account takeover](https://agentprime.io/advisories/CVE-2026-59239.md)
  `CVE-2026-59239` · CVE record: Roskus Prospero Flow CRM · CVSS 8.6 High · Not analysed yet · Published 27 Jul 2026 · Tags: Cross-site scripting (XSS)
- [IDOR in Prospero Flow CRM Order API allows cross-tenant read and modification of orders](https://agentprime.io/advisories/CVE-2026-59237.md)
  `CVE-2026-59237` · CVE record: Roskus Prospero Flow CRM · CVSS 6.9 Medium · Not analysed yet · Published 16 Jul 2026 · Tags: Broken access control
- [Authorization bypass in Prospero Flow CRM Excel import allows cross-tenant record injection](https://agentprime.io/advisories/CVE-2026-59236.md)
  `CVE-2026-59236` · CVE record: Roskus Prospero Flow CRM · CVSS 6.9 Medium · Not analysed yet · Published 15 Jul 2026 · Tags: Broken access control
- [Missing authorization in Prospero Flow CRM allows low-privileged users to read all bank accounts](https://agentprime.io/advisories/CVE-2026-59235.md)
  `CVE-2026-59235` · CVE record: Roskus Prospero Flow CRM · CVSS 8.7 High · Not analysed yet · Published 15 Jul 2026 · Tags: Broken access control
- [Authorization Bypass Through User-Controlled Key in Prospero Flow CRM calendar event deletion](https://agentprime.io/advisories/CVE-2026-59234.md)
  `CVE-2026-59234` · CVE record: Roskus Prospero Flow CRM · CVSS 6.9 Medium · Not analysed yet · Published 3 Jul 2026 · Tags: Broken access control

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=roskus-prospero-flow-crm>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/roskus-prospero-flow-crm/>. Everything for agents: <https://agentprime.io/llms.txt>.