The vulnerability is an IDOR flaw in the Order and OrderItem REST API controllers of Roskus Prospero Flow CRM that allows a remote, authenticated user to access, modify, or delete orders and order items belonging to any company. The issue stems from controllers resolving records with Order::find($id) / Item::find($id) without scoping by the authenticated user's tenant, enabling cross‑tenant exploitation. This is a classic authorization bypass, categorized as CWE‑639, that permits leakage and tampering of sensitive commercial data across tenants.

Roskus Prospero Flow CRM versions prior to 5.5.3 are affected. The vulnerability manifests when making requests to GET /api/order/{id}, PUT /api/order/{id}, GET /api/order-item/{id}, PUT /api/order-item/{id}, or DELETE /api/order-item/{id} with a sequential numeric {id}. Users of any tenant who are authenticated can therefore reach orders or items that belong to other tenants.

The CVSS score of 6.9 indicates moderate severity, and the EPSS score of less than 1% suggests a low probability of exploitation; the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector involves a remote, authenticated user constructing the numeric ID to target records belonging to other tenants via the exposed REST endpoints. Successfully exploiting the flaw requires only legitimate authentication credentials and does not rely on additional local or privileged access. The impact is significant for confidentiality and integrity of cross‑tenant data; given the existing scope and lack of mitigation, the vulnerability poses a measurable risk to organizations running affected versions.