VULNERABILITY INTELLIGENCE
CVE-2026-19433
CVSS score8.6 HIGH
EPSS probability0.44%
CISA KEVNot currently listed
Published2026-08-10
Last modified2026-10-23
CVSS vectorCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Description
Authorization Bypass Through User-Controlled Key in the contact management component in Roskus Prospero Flow CRM before 5.4.8 allows authenticated users of any company to blindly overwrite the contact data of another company and to download that contact's personal data as a vCard via the contact's numeric identifier, because the save and export operations retrieve the record without constraining the query to the authenticated user's company.
Weakness classification
- CWE-639: Authorization Bypass Through User-Controlled Key