External risk intelligence

Roskus Prospero Flow CRM Supplier API Authorization Bypass

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-78365

The vulnerability resides in a supplier API endpoint of a CRM application. CRM platforms and their associated APIs are commonly deployed as internet-facing web services to facilitate remote access for employees and integration with external partners, making the API surface frequently reachable from the public internet.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This critical vulnerability affects a customer relationship management system's supplier API, allowing any authenticated user to access and modify another company's supplier records. At a high level, this could lead to unauthorized data manipulation and a disruption of business operations.

Any user can change other companies' supplier data.
Critical CRM flaw impacts data integrity and business operations.
Confirm relevance and assess exposure for business continuity.

Attack Path

How an attacker could exploit the issue

An attacker with any authenticated user account could exploit this vulnerability by sending a specially crafted request to the supplier API. This request would target a specific supplier record and include a modified company ID, effectively allowing the attacker to view, change, or reassign another company's supplier information to their own.

Requires authenticated user access.
Triggered via a PUT request to the supplier API.
Risk of unauthorized data modification and reassignment.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, any authenticated user could potentially access and modify supplier records belonging to other companies within the Roskus Prospero Flow CRM. This occurs when an authenticated user makes a PUT request to the supplier API, specifying a different company ID in the request body.

Company supplier data.
Via PUT request to supplier API.
Unauthorized data modification and reassignment.

Operational Fix

Recommended remediation, mitigation, and detection steps

The supplier API in Roskus Prospero Flow CRM is likely managed by the application or platform team responsible for the CRM's functionality and deployment. The first practical move is to identify all instances of this CRM, determine their exposure and criticality, and confirm the accountable owner for each. Remediation planning should then be based on this risk assessment.

Application or platform team owns the issue.
Verify CRM instances and exposure.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Roskus Prospero Flow CRM?

Roskus Prospero Flow CRM is a customer relationship management platform used by organizations to track interactions, manage sales pipelines, and maintain databases of business contacts and suppliers. It centralizes vendor information, making it a critical component for managing supply chain relationships and operational business data.

What does CWE-639 and CWE-862 mean for CVE-2026-78365?

These codes indicate a failure in how the software controls access to data. Specifically, the system fails to verify if a logged-in user is actually authorized to view or edit the specific record they are requesting. Because of this, the application treats any request for a supplier record as valid, even if that record belongs to a different company, leading to an authorization bypass.

How does an attacker trigger this vulnerability?

An attacker must hold an active user account within the CRM to initiate the request. The vulnerability is triggered by sending a specially crafted PUT request to the supplier API endpoint. Simply navigating the user interface or performing standard read-only actions without targeting that specific API call does not trigger the flaw.

Is my instance of Roskus Prospero Flow CRM at risk?

Halo Surface Signal indicates that because CRM platforms often function as internet-facing services to allow remote employee access and partner integrations, this API is frequently reachable from the public internet. If your instance is accessible via the web, the risk of unauthorized external access to your supplier data is significantly higher compared to internal-only deployments.

What should I do first to address this issue?

Start by performing an inventory to locate all deployed instances of Roskus Prospero Flow CRM across your organization. Once identified, confirm which instances are accessible via the network and determine who is responsible for managing that specific CRM environment. Use this information to prioritize patching or restricting access to the affected API endpoints based on your internal business criticality.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.