Roskus vulnerabilities
We track 11 vulnerabilities in Roskus products. 11 are rated high or critical, and none are known to be exploited. The most recent was published on October 22, 2026.
Latest Roskus vulnerabilities
- 8.6 High severity
Prospero Flow CRM: Missing Authorization
Missing Authorization (CWE-862) in the user API of Roskus Prospero Flow CRM from 2.0.0 before 5.26.0 allows a user with a basic role to read the accounts of other users of its own company, including accounts with higher privileges, and, in versions from 3.5.0,
- 9.3 Critical severity
Prospero Flow CRM: Authorization Bypass Through User-Controlled Key
Authorization Bypass Through User-Controlled Key in the supplier API in Roskus Prospero Flow CRM 4.0.0 through 5.3.1 allows any authenticated user to read and modify another company's supplier record, and to reassign it to their own company, via a PUT request
- 8.7 High severity
Prospero Flow CRM: Authorization Bypass Through User-Controlled Key
Authorization Bypass Through User-Controlled Key in the transaction API in Roskus Prospero Flow CRM 5.0.0 through 5.3.5 allows an authenticated user to read the transactions of other companies on the same instance via an incremented identifier in GET /api/tran
- 9.3 Critical severity
Prospero Flow CRM: Use of Hard-coded Credentials
Use of Hard-coded Credentials in the human resources component in Roskus Prospero Flow CRM before 5.15.9 allows unauthenticated remote attackers to authenticate as any employee onboarded through the standard flow, knowing only their email address, because the
- 8.6 High severity
Prospero Flow CRM: Authorization Bypass Through User-Controlled Key
Authorization Bypass Through User-Controlled Key in the payroll module in Roskus Prospero Flow CRM before 5.15.10 allows authenticated users holding the read payroll permission to view the salary and banking details of employees of any other company in the ins
- 8.6 High severity
Prospero Flow CRM: Authorization Bypass Through User-Controlled Key
Missing Authorization and Authorization Bypass Through User-Controlled Key in the product management component in Roskus Prospero Flow CRM before 5.4.7 allows authenticated users of any company to read the full sensitive data (price, cost, stock, SKU, and barc
- 8.6 High severity
Prospero Flow CRM: Missing Authorization
Authorization Bypass Through User-Controlled Key in the ticket management component in Roskus Prospero Flow CRM before 5.4.9 allows authenticated users of any company to read the full content (title, description, and attachments) of tickets belonging to anothe
- 8.6 High severity
Prospero Flow CRM: Authorization Bypass Through User-Controlled Key
Authorization Bypass Through User-Controlled Key in the contact management component in Roskus Prospero Flow CRM before 5.4.8 allows authenticated users of any company to blindly overwrite the contact data of another company and to download that contact's pers
- 8.7 High severity
Prospero Flow CRM: Authorization Bypass Through User-Controlled Key
Missing Authorization in the permission management component in Roskus Prospero Flow CRM before 5.2.1 allows any authenticated user to grant any role, including their own, the complete set of application permissions via a crafted POST request to the permission
- 8.6 High severity
Prospero Flow CRM: Improper Neutralization of Input During Web Page Generation
Stored Cross-site Scripting (CWE-79) in the email module in Roskus Prospero Flow CRM before 5.4.4 allows a remote, authenticated low-privileged user to execute arbitrary JavaScript in another user's browser, including administrators, leading to session comprom
- 8.7 High severity
Prospero Flow CRM: Authorization Bypass Through User-Controlled Key
Missing Authorization (CWE-862) in BankAccountListController (app/Http/Controllers/Api/BankAccount/BankAccountListController.php), exposed at GET /api/bank-account, in Prospero Flow CRM <5.5.3, which allows a remote, authenticated attacker holding a low-privil