https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 01 Oct 2026 07:07:22 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-19734 <p>Missing Authorization and Authorization Bypass Through User-Controlled Key in the product management component in Roskus Prospero Flow CRM before 5.4.7 allows authenticated users of any company to read the full sensitive data (price, cost, stock, SKU, and barcode) of another company&#39;s product and to hijack that product by reassigning its company_id, via the product&#39;s numeric identifier, because `ProductUpdateController` did not extend `MainController` and therefore required no authentication check on the read endpoint, and `ProductRepository::save()` retrieved the record via `Product::find($data[&#39;id&#39;])` without constraining the query to the authenticated user&#39;s company before overwriting its company_id.</p> <p>Missing Authorization and Authorization Bypass Through User-Controlled Key in the product management component in Roskus Prospero Flow CRM before 5.4.7 allows authenticated users of any company to read the full sensitive data (price, cost, stock, SKU, and barcode) of another company&#39;s product and to hijack that product by reassigning its company_id, via the product&#39;s numeric identifier, because `ProductUpdateController` did not extend `MainController` and therefore required no authentication check on the read endpoint, and `ProductRepository::save()` retrieved the record via `Product::find($data[&#39;id&#39;])` without constraining the query to the authenticated user&#39;s company before overwriting its company_id.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-19734 https://vulnerability.circl.lu/vuln/ghsa-xrvm-rxhf-gwgp <p>Missing Authorization and Authorization Bypass Through User-Controlled Key in the product management component in Roskus Prospero Flow CRM before 5.4.7 allows authenticated users of any company to read the full sensitive data (price, cost, stock, SKU, and barcode) of another company&#39;s product and to hijack that product by reassigning its company_id, via the product&#39;s numeric identifier, because `ProductUpdateController` did not extend `MainController` and therefore required no authentication check on the read endpoint, and `ProductRepository::save()` retrieved the record via `Product::find($data[&#39;id&#39;])` without constraining the query to the authenticated user&#39;s company before overwriting its company_id.</p> <p>Missing Authorization and Authorization Bypass Through User-Controlled Key in the product management component in Roskus Prospero Flow CRM before 5.4.7 allows authenticated users of any company to read the full sensitive data (price, cost, stock, SKU, and barcode) of another company&#39;s product and to hijack that product by reassigning its company_id, via the product&#39;s numeric identifier, because `ProductUpdateController` did not extend `MainController` and therefore required no authentication check on the read endpoint, and `ProductRepository::save()` retrieved the record via `Product::find($data[&#39;id&#39;])` without constraining the query to the authenticated user&#39;s company before overwriting its company_id.</p> https://vulnerability.circl.lu/vuln/ghsa-xrvm-rxhf-gwgp