An authorization flaw in the Roskus Prospero Flow CRM supplier API permits authenticated users to unauthorizedly read and modify records belonging to other companies.

This is an Insecure Direct Object Reference (IDOR) vulnerability (CWE-639, CWE-862). By manipulating the company_id field in a PUT request to the /api/supplier/{id} endpoint, an authenticated user can bypass authorization checks to access or overwrite data belonging to other tenants.

The CVSS score of 9.3 highlights a significant risk of data exposure and cross-tenant integrity compromise. Successful exploitation could lead to the theft of supplier information, financial fraud through the modification of bank details, and severe reputational damage to the organization hosting the CRM.

Immediate Action: Upgrade to version 5.3.2 or later (v5.5.3 is the first fully tagged release with the fix).

Proactive Monitoring: Audit the supplier database for any records where the company_id has been modified unexpectedly and rotate any exposed order-portal or financial credentials.

Compensating Controls: Utilize application-level access controls and API gateways to enforce strict tenant isolation and validate request ownership before processing data modifications.

Public Exploit Available: No

Organizations using Prospero Flow CRM must update to the patched versions immediately to prevent unauthorized data manipulation. Security teams should also perform a forensic review of supplier records to ensure no unauthorized cross-tenant modifications occurred prior to the patch.