The vulnerability is an Authorization Bypass through User‑Controlled Key that allows an authenticated user to read, reassign, and delete tickets belonging to other companies. The flaw exists because ticket queries, including read and save operations, do not constrain the record to the authenticated user’s company, and the delete endpoint accepts a generic request that bypasses permission checks. The result is that a user can view confidential ticket content, hijack management of tickets across tenants, and permanently remove data belonging to other organizations. The weakness is classified as CWE‑862, indicating an authorization bypass that can lead to confidentiality, integrity, and availability violations for affected tenants.

Roskus Prospero Flow CRM before version 5.4.9 is vulnerable. The software releases from 5.4.9 onward fix the issue; the vendor recommends upgrading to 5.4.9 or higher.

The CVSS score of 8.6 indicates a high‑severity vulnerability. Although EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog, the nature of the flaw (an IDOR that permits sensitive data exposure and destructive actions across tenants) makes it likely to be targeted by attackers who can authenticate within the system. Because the attack requires only the ability to supply a ticket numeric identifier—a common parameter in the application—the attack surface is wide, and the exploit can be automated by enumerating ticket IDs. The lack of an authorization guard in the delete controller further lowers the barrier to exploitation.