# CVE-2026-114519: Missing authorization in the Prospero Flow CRM user API allows a basic role user to read and delete other accounts

Status: published. Published: 2026-10-22. Updated: 2026-11-02.

Missing Authorization (CWE-862) in the user API of Roskus Prospero Flow CRM from 2.0.0 before 5.26.0 allows a user with a basic role to read the accounts of other users of its own company, including accounts with higher privileges, and, in versions from 3.5.0, to delete them, because the routes GET /api/user/{id} and DELETE /api/user/{id} in routes/api.php carry only the auth:api middleware, which checks that a JSON Web Token is valid and nothing more, and neither UserReadController::read() nor UserDeleteController::delete() checks a permission, a policy or a role before acting. Object access is scoped by company: the read path limits the query to the company of the authenticated user, and the delete path compares the company of the target account with the company of the authenticated user. The delete path skips that comparison when the company of the authenticated user is Company::DEFAULT_COMPANY, so a user with a basic role in that company can delete any account of any company of the installation. Deleting an account removes the data held on it, and the last administrative account of a company can be deleted. This gives the attacker the personal data held on the other accounts, including email address, telephone number, postal address and IBAN, and the ability to delete accounts it has no permission to administer.

## Remediation

- fix: Upgrade to Roskus Prospero Flow CRM 5.26.0 or later. (source: CNA: Secur0)

## Affected products and versions

- Roskus / Prospero Flow CRM: ≥ 2.0.0; < 5.26.0 (affected, semver). Source: CNA: Secur0

## Severity and prioritization

- CVSS 4.0: 8.6 (high); CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N; source: CNA: Secur0

- CISA KEV: No listing in collected sources

- EPSS: 0.36% as of 2026-11-02; percentile 29.49%

- SSVC: exploitation none; automatable no; technical impact total; source ADP: CISA-ADP

- Weaknesses: CWE-862

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://github.com/Roskus/prospero-flow-crm/commit/52cd172ccc7c3332805d9e0b7fc992bda3d422bf (CNA: Secur0; patch)

- https://secur0.com/en/cna/cve-list/cve-2026-114519-missing-authorization-user-api (CNA: Secur0; third-party-advisory, technical-description)

## Provenance

- CNA: Secur0: https://www.cve.org/CVERecord?id=CVE-2026-114519; retrieved 2026-11-02; source updated 2026-11-02

- FIRST EPSS: https://api.first.org/data/v1/epss?cve=CVE-2026-114519; retrieved 2026-11-02; source updated Not reported

Revision: a90ec95b5ef3409e9549d4c6401867a8f148d6f55367506aee64767b5ef6a5d8

Canonical: https://y2.dev/cve/CVE-2026-114519

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.