Gustavo Novaro

IDOR in Prospero Flow CRM allows cross-tenant ticket read, hijacking, and deletion

Authorization Bypass Through User-Controlled Key in Prospero Flow CRM contact save and vCard export

Missing Authorization in Prospero Flow CRM permission save endpoint allows privilege escalation

Stored Cross-site Scripting in Prospero Flow CRM lead name field

IDOR in Prospero Flow CRM allows deletion of other users' notifications

Stored XSS in Prospero Flow CRM email body allows administrator account takeover

IDOR in Prospero Flow CRM Order API allows cross-tenant read and modification of orders

Missing authorization in Prospero Flow CRM allows low-privileged users to read all bank accounts

Authorization bypass in Prospero Flow CRM Excel import allows cross-tenant record injection

Authorization Bypass Through User-Controlled Key in Prospero Flow CRM calendar event deletion