Most recent entries from all https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 07:49:32 +0000 CVE-2026-78365 — IDOR and missing authorization in Prospero Flow CRM supplier API allows cross-tenant read and modification https://cve.radiocsirt.org/vuln/cve-2026-78365 <p><strong>Affected:</strong> Roskus Prospero Flow CRM</p> <p>Authorization Bypass Through User-Controlled Key in the supplier API in Roskus Prospero Flow CRM 4.0.0 through 5.3.1 allows any authenticated user to read and modify another company&#39;s supplier record, and to reassign it to their own company, via a PUT request to /api/supplier/{id} setting company_id in the body.</p> <p><strong>Affected:</strong> Roskus Prospero Flow CRM</p> <p>Authorization Bypass Through User-Controlled Key in the supplier API in Roskus Prospero Flow CRM 4.0.0 through 5.3.1 allows any authenticated user to read and modify another company&#39;s supplier record, and to reassign it to their own company, via a PUT request to /api/supplier/{id} setting company_id in the body.</p> https://cve.radiocsirt.org/vuln/cve-2026-78365