Read the docs
TI-2026-16110 Aliases CVE-2026-19871GHSA-pw58-qr35-gpr4

Use of hard-coded credentials in Prospero Flow CRM employee onboarding

Priority MEDIUM 49CWE-798Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-798.

Summary

Use of Hard-coded Credentials in the human resources component in Roskus Prospero Flow CRM before 5.15.9 allows unauthenticated remote attackers to authenticate as any employee onboarded through the standard flow, knowing only their email address, because the employee save controller falls back to the literal password "changeme" and the onboarding form provides no password field.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0053 45th percentileScored 2026-11-07
Fix Fixed Prospero Flow CRM (Roskus): 5.15.9

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
RoskusProspero Flow CRMbefore 5.15.95.15.9Patch availableCNA
  • Prospero Flow CRM VendorRoskus Affected before 5.15.9 Fixed in 5.15.9 Patch available CNA

Remediation

  • Fix · CNA Prospero Flow CRM (Roskus) Fixed in 5.15.9

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-19871
  2. 2026-10-03 Alias added: GHSA-pw58-qr35-gpr4

References

Patch 1

Other 1

  • TI-2026-54500 IDOR and missing authorization in Prospero Flow CRM supplier API allows cross-tenant read and modification CVSS 4.0CRITICAL 9.3
  • TI-2026-42380 Stored XSS in Prospero Flow CRM email body allows administrator account takeover CVSS 4.0HIGH 8.6
  • TI-2026-42376 Missing authorization in Prospero Flow CRM allows low-privileged users to read all bank accounts CVSS 4.0HIGH 8.7
  • TI-2026-54153 IDOR and missing authorization in the Prospero Flow CRM transaction API allow cross-tenant reading of financial records CVSS 4.0HIGH 8.7
  • TI-2026-42374 Missing Authorization in Prospero Flow CRM permission save endpoint allows privilege escalation CVSS 4.0HIGH 8.7
  • TI-2026-16008 IDOR in Prospero Flow CRM allows cross-tenant product disclosure and hijacking CVSS 4.0HIGH 8.6
See all 19 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences