CVE-2026-19871

9.3 Critique

Publiée le 14/08/2026 à 16:16 · Modifiée le 01/09/2026 à 22:52 · Analyse NVD reportée · Source : 4daa8cea-433a-44bd-9456-53b127fc289a

Description

Use of Hard-coded Credentials in the human resources component in Roskus Prospero Flow CRM before 5.15.9 allows unauthenticated remote attackers to authenticate as any employee onboarded through the standard flow, knowing only their email address, because the employee save controller falls back to the literal password "changeme" and the onboarding form provides no password field.

Traduire en français

Produits concernés

Roskus Prospero Flow CRM

Scores CVSS

Version	Score	Source	Vecteur
4.0	9.3 Critique	4daa8cea-433a-44bd-9456-53b127fc289a	`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X`

Faiblesses (CWE)

CWE-798

Références

https://github.com/Roskus/prospero-flow-crm/commit/5cc01ed958db4ad0a026a8daa1c6a8bb98a43e66
https://secur0.com/en/cna/cve-list/cve-2026-19871-hardcoded-credentials-in-prospero-flow-crm-employee-onboarding

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories