https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T23:54:26.063499+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-78365 CVE-2026-78365 — IDOR and missing authorization in Prospero Flow CRM supplier API allows cross-tenant read and modification 2026-10-07T23:54:26.081472+00:00

Affected: Roskus Prospero Flow CRM

Authorization Bypass Through User-Controlled Key in the supplier API in Roskus Prospero Flow CRM 4.0.0 through 5.3.1 allows any authenticated user to read and modify another company's supplier record, and to reassign it to their own company, via a PUT request to /api/supplier/{id} setting company_id in the body.