Missing authorization in the user API of Roskus Prospero Flow CRM allows any authenticated user with a basic role to read the personal data of other users within the same company, and in releases from 3.5.0 onward to delete those accounts. Because the routes only enforce a valid JSON Web Token and provide no role, permission, or policy checks, an attacker can retrieve email addresses, phone numbers, postal addresses, and IBANs, and can destroy the target account and its stored data. Deleting the sole administrative account of a company can also disable administrative control over that company’s data.

The vulnerability exists in Roskus Prospero Flow CRM versions 2.0.0 through 5.25.9; account deletion is possible in versions 3.5.0 and newer. The issue is scoped to company boundaries, but the delete path incorrectly skips the company comparison when the authenticated user belongs to the special Company::DEFAULT_COMPANY, effectively allowing a basic‐role user in that company to delete accounts from any company.

The CVSS score of 8.6 indicates high severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog; however, the attack can be executed by any user who can authenticate to the API, meaning the exploitation potential is significant within an installation. The lack of privilege checks makes the risk high for organizations that use the default company or fail to restrict basic user permissions.