The vulnerability is an authorization bypass (CWE‑639) that occurs in the Excel import handlers for customers, leads, and products. An authenticated user, regardless of role or company affiliation, can upload a spreadsheet containing rows whose company_id field points to another tenant. The import endpoint maps the provided company_id directly into the database without verifying that it matches the uploader’s own tenant. Consequently a user can create records inside a victim tenant, undermining data isolation, confidentiality, and integrity for that tenant’s records.

Roskus Prospero Flow CRM before version 5.14.0 is affected. The vulnerability is present in the Excel import functionality for all products and leads and in all versions prior to the 5.14.0 release, which includes the legacy code that neither checks the authenticated user's company nor sanitises the company_id column.

The CVSS base score of 6.9 indicates a moderate severity, but the EPSS score of less than 1% shows a very low probability of exploitation. The vulnerability is not listed in CISA KEV. The likely attack vector involves an authenticated user uploading a crafted Excel file to the POST /customer/import/excel/save endpoint; the exploit requires no additional privileges or network access beyond normal REST API usage.