A Claude-assisted change added order API handlers that fetched records by ID without checking the caller's company, so users of one company could read or change another company's orders.

How AI contributed: Direct introductionPublished Jul 16, 2026 in roskus/prospero-flow-crmAll 3 findings in this repository

Provisional finding. Full causal and release verification remains incomplete.

What actually happened

Prospero Flow CRM's new order and order-item API looked records up by ID across all companies and never checked that the record belonged to the caller's company, although the neighbouring list and delete handlers did. Any authenticated API user could read another company's order and its items, and users with order permissions could change another company's order or read, change or delete its items. A Claude-assisted change added the order read and update handlers this way, and a later change added the item handlers with the same lookup. The fix, three days later, scopes all five lookups to the caller's company. The vulnerable code was never in a tagged release: the release before it has no API and the next one already contains the fix, so the advisory's version range overstates what shipped.

Root cause

Authentication & access control introduced

A Claude-assisted change adds order read and update endpoints that look orders up by ID without a company check.

AI-assisted change: Claude

56ea64c80f

app/Http/Controllers/Api/Order/OrderReadController.php app/Http/Controllers/Api/Order/OrderUpdateController.php

Fix

Security fix

The repair scopes the order and order-item lookups to the caller's company.

Fix authorship not yet analyzed

9a859c4de3

app/Http/Controllers/Api/Order/OrderReadController.php app/Http/Controllers/Api/Order/OrderUpdateController.php app/Http/Controllers/Api/Order/OrderItemReadController.php

Case facts

CVE ID: CVE-2026-59237
GHSA ID: GHSA-X8QQ-M4QC-RPJ5
Published: Jul 16, 2026
Severity: Not scored
Language: PHP
AI tool: Claude
AI role: Direct introduction
Fixed release: v5.5.3

Advisory source

AI-assisted change

AI-assisted changeapp/Http/Controllers/Api/Order/OrderReadController.php source roskus/prospero-flow-crm@56ea64c80f+42−0

@@ -0,0 +1,42 @@+<?php++declare(strict_types=1);

Show 27 hidden lines

++namespace App\Http\Controllers\Api\Order;++use App\Models\Order;+use Illuminate\Http\JsonResponse;+use OpenApi\Attributes as OAT;++class OrderReadController+{+    #[OAT\Get(+        path: '/order/{id}',+        summary: 'Get Order details',+        security: [['bearerAuth' => []]],+        tags: ['Order'],+        parameters: [+            new OAT\Parameter(+                name: 'id',+                in: 'path',+                required: true,+                description: 'Order ID',+                schema: new OAT\Schema(type: 'integer')+            ),+        ],+        responses: [+            new OAT\Response(response: 200, description: 'Order found'),+            new OAT\Response(response: 404, description: 'Order not found'),+        ]

+    )]+    public function read(int $id): JsonResponse+    {+        $order = Order::find($id);++        if (! $order) {+            return response()->json(['message' => 'Order not found'], 404);

Show 5 hidden lines

+        }++        return response()->json(['order' => $order], 200);+    }+}

Adds the order read endpoint, which loads the order named by the URL with a global lookup and never compares its company with the caller's company.

AI-assisted changeapp/Http/Controllers/Api/Order/OrderUpdateController.php source roskus/prospero-flow-crm@56ea64c80f+55−0

@@ -0,0 +1,55 @@+<?php++declare(strict_types=1);

Show 35 hidden lines

++namespace App\Http\Controllers\Api\Order;++use App\Http\Requests\OrderUpdateRequest;+use App\Models\Order;+use Illuminate\Http\JsonResponse;+use Illuminate\Support\Facades\Auth;+use OpenApi\Attributes as OAT;++class OrderUpdateController+{+    #[OAT\Put(+        path: '/order/{id}',+        summary: 'Update an Order',+        security: [['bearerAuth' => []]],+        tags: ['Order'],+        parameters: [+            new OAT\Parameter(+                name: 'id',+                in: 'path',+                required: true,+                description: 'Order ID',+                schema: new OAT\Schema(type: 'integer')+            ),+        ],+        requestBody: new OAT\RequestBody(+            required: true,+            content: new OAT\JsonContent(ref: '#/components/schemas/Order')+        ),+        responses: [+            new OAT\Response(response: 200, description: 'Order updated successfully'),+            new OAT\Response(response: 403, description: 'Unauthorized'),+            new OAT\Response(response: 404, description: 'Order not found'),+            new OAT\Response(response: 422, description: 'Validation failed'),+        ]

+    )]+    public function update(OrderUpdateRequest $request, int $id): JsonResponse+    {+        $order = Order::find($id);++        if (! $order) {+            return response()->json(['message' => 'Order not found'], 404);

Show 10 hidden lines

+        }++        $data = $request->validated();+        $data['updated_by'] = Auth::user()->id;++        $order->update($data);++        return response()->json(['order' => $order], 200);+    }+}

Adds the order update endpoint with the same global lookup, so a user allowed to update orders can change another company's order.

Security fix

Fixapp/Http/Controllers/Api/Order/OrderReadController.php source roskus/prospero-flow-crm@9a859c4de3+3−1

@@ -31,7 +32,9 @@ class OrderReadController     )]     public function read(int $id): JsonResponse     {-        $order = Order::with('items')->find($id);+        $order = Order::where('company_id', Auth::user()->company_id)+            ->with('items')+            ->find($id);

Show 2 hidden lines

         if (! $order) {             return response()->json(['message' => 'Order not found'], 404);

Limits the order read lookup to orders that belong to the caller's company.

Fixapp/Http/Controllers/Api/Order/OrderUpdateController.php source roskus/prospero-flow-crm@9a859c4de3+1−1

@@ -39,7 +39,7 @@ class OrderUpdateController     )]     public function update(OrderUpdateRequest $request, int $id): JsonResponse     {-        $order = Order::find($id);+        $order = Order::where('company_id', Auth::user()->company_id)->find($id);          if (! $order) {             return response()->json(['message' => 'Order not found'], 404);

Limits the order update lookup to the caller's company in the same way.

Fixapp/Http/Controllers/Api/Order/OrderItemReadController.php source roskus/prospero-flow-crm@9a859c4de3+3−1

@@ -31,7 +32,9 @@ class OrderItemReadController     )]     public function read(int $id): JsonResponse     {-        $item = Item::find($id);+        $item = Item::whereHas('order', function ($query) {+            $query->where('company_id', Auth::user()->company_id);+        })->find($id);

Show 3 hidden lines

          if (! $item) {             return response()->json(['message' => 'Item not found'], 404);

Applies the company check to order items through their parent order; the item update and delete handlers receive the identical change.

Patch fingerprints

AI-assisted change 4f2e22a1a24b346894232301123bd0b13ca3ae2ec891debe983e1bd570b1d5b6 · Fix 9f1aa943aa2f393335fe7a4687b0826c4c3cbf1e6cbd111eebb0536db42cc332

A Claude-assisted change added order API handlers that fetched records by ID without checking the caller's company, so users of one company could read or change another company's orders.

Provisional finding. Full causal and release verification remains incomplete.

What actually happened

AI-assisted change

AI-assisted changeapp/Http/Controllers/Api/Order/OrderReadController.php source roskus/prospero-flow-crm@56ea64c80f+42−0

@@ -0,0 +1,42 @@+<?php++declare(strict_types=1);

Show 27 hidden lines

++namespace App\Http\Controllers\Api\Order;++use App\Models\Order;+use Illuminate\Http\JsonResponse;+use OpenApi\Attributes as OAT;++class OrderReadController+{+    #[OAT\Get(+        path: '/order/{id}',+        summary: 'Get Order details',+        security: [['bearerAuth' => []]],+        tags: ['Order'],+        parameters: [+            new OAT\Parameter(+                name: 'id',+                in: 'path',+                required: true,+                description: 'Order ID',+                schema: new OAT\Schema(type: 'integer')+            ),+        ],+        responses: [+            new OAT\Response(response: 200, description: 'Order found'),+            new OAT\Response(response: 404, description: 'Order not found'),+        ]

+    )]+    public function read(int $id): JsonResponse+    {+        $order = Order::find($id);++        if (! $order) {+            return response()->json(['message' => 'Order not found'], 404);

Show 5 hidden lines

+        }++        return response()->json(['order' => $order], 200);+    }+}

Adds the order read endpoint, which loads the order named by the URL with a global lookup and never compares its company with the caller's company.

AI-assisted changeapp/Http/Controllers/Api/Order/OrderUpdateController.php source roskus/prospero-flow-crm@56ea64c80f+55−0

@@ -0,0 +1,55 @@+<?php++declare(strict_types=1);

Show 35 hidden lines

++namespace App\Http\Controllers\Api\Order;++use App\Http\Requests\OrderUpdateRequest;+use App\Models\Order;+use Illuminate\Http\JsonResponse;+use Illuminate\Support\Facades\Auth;+use OpenApi\Attributes as OAT;++class OrderUpdateController+{+    #[OAT\Put(+        path: '/order/{id}',+        summary: 'Update an Order',+        security: [['bearerAuth' => []]],+        tags: ['Order'],+        parameters: [+            new OAT\Parameter(+                name: 'id',+                in: 'path',+                required: true,+                description: 'Order ID',+                schema: new OAT\Schema(type: 'integer')+            ),+        ],+        requestBody: new OAT\RequestBody(+            required: true,+            content: new OAT\JsonContent(ref: '#/components/schemas/Order')+        ),+        responses: [+            new OAT\Response(response: 200, description: 'Order updated successfully'),+            new OAT\Response(response: 403, description: 'Unauthorized'),+            new OAT\Response(response: 404, description: 'Order not found'),+            new OAT\Response(response: 422, description: 'Validation failed'),+        ]

+    )]+    public function update(OrderUpdateRequest $request, int $id): JsonResponse+    {+        $order = Order::find($id);++        if (! $order) {+            return response()->json(['message' => 'Order not found'], 404);

Show 10 hidden lines

+        }++        $data = $request->validated();+        $data['updated_by'] = Auth::user()->id;++        $order->update($data);++        return response()->json(['order' => $order], 200);+    }+}

Adds the order update endpoint with the same global lookup, so a user allowed to update orders can change another company's order.

Security fix

Fixapp/Http/Controllers/Api/Order/OrderReadController.php source roskus/prospero-flow-crm@9a859c4de3+3−1

@@ -31,7 +32,9 @@ class OrderReadController     )]     public function read(int $id): JsonResponse     {-        $order = Order::with('items')->find($id);+        $order = Order::where('company_id', Auth::user()->company_id)+            ->with('items')+            ->find($id);

Show 2 hidden lines

         if (! $order) {             return response()->json(['message' => 'Order not found'], 404);

Limits the order read lookup to orders that belong to the caller's company.

Fixapp/Http/Controllers/Api/Order/OrderUpdateController.php source roskus/prospero-flow-crm@9a859c4de3+1−1

@@ -39,7 +39,7 @@ class OrderUpdateController     )]     public function update(OrderUpdateRequest $request, int $id): JsonResponse     {-        $order = Order::find($id);+        $order = Order::where('company_id', Auth::user()->company_id)->find($id);          if (! $order) {             return response()->json(['message' => 'Order not found'], 404);

Limits the order update lookup to the caller's company in the same way.

Fixapp/Http/Controllers/Api/Order/OrderItemReadController.php source roskus/prospero-flow-crm@9a859c4de3+3−1

@@ -31,7 +32,9 @@ class OrderItemReadController     )]     public function read(int $id): JsonResponse     {-        $item = Item::find($id);+        $item = Item::whereHas('order', function ($query) {+            $query->where('company_id', Auth::user()->company_id);+        })->find($id);

Show 3 hidden lines

          if (! $item) {             return response()->json(['message' => 'Item not found'], 404);

Applies the company check to order items through their parent order; the item update and delete handlers receive the identical change.