Missing authorization in the product management component of Roskus Prospero Flow CRM allows an authenticated user from any tenant to read sensitive data—price, cost, stock, SKU, and barcode—of another tenant’s products. The flaw also enables the attacker to hijack the product by reassigning its company_id via the numeric identifier; ProductUpdateController does not extend MainController and therefore skips the authentication check, and ProductRepository::save() retrieves the record by Product::find($data['id']) without scoping it to the user’s tenant. This exemplifies a Missing Authorization weakness (CWE‑639) and exposes the enterprise to data leakage and inventory tampering.

The affected product is Prospero Flow CRM from vendor Roskus. All releases prior to 5.4.7 are vulnerable. Users running any earlier version must review their deployment for this approved issue.

The CVSS score of 8.6 indicates a high severity vulnerability, and the absence of an EPSS rating suggests no known exploit activity yet, though the flaw is straightforward to exploit for any authenticated user. Because the attack requires legitimate credentials within the system, the risk is mitigated only by ensuring that all users are subject to tenant‑bound authorization checks. Without the 5.4.7 patch the CVE remains a significant threat, and the vulnerability is not listed in the CISA KEV catalog, so no known ongoing attacks have been reported.