Summary
CVE-2026-19871 is a critical use of hard-coded credentials vulnerability (CWE-798) in the human resources module of Roskus Prospero Flow CRM. The employee onboarding controller silently defaults to the literal password "changeme" whenever an administrator creates an employee record without explicitly supplying a password, allowing a remote, unauthenticated attacker who knows (or guesses) an employee’s email address to log in as that employee. The issue affects all versions prior to 5.15.9 and carries a CVSS score of 9.3 (Critical).
Technical details
- Root cause: In
EmployeeSaveController(app/Http/Controllers/Rrhh/Employee/EmployeeSaveController.php), employee password creation was implemented asbcrypt($request->input('password', 'changeme'))— if no password value is submitted during onboarding, the application hashes and stores the static stringchangemeas the account’s password instead of generating a random credential. - Trigger conditions: Any employee record created through the standard HR onboarding form (
resources/views/rrhh/employee/_form.blade.php) without an explicit password field being populated will silently receive the defaultchangemecredential. - Attack vector: Network — no authentication or user interaction is required. An attacker only needs a valid employee email address (which may be guessable, harvested, or match common corporate email naming conventions) to attempt login using
changemeas the password. - Impact: Successful exploitation grants full authenticated access to the CRM as the compromised employee account, exposing confidential HR, contact, and business data, and potentially enabling further lateral movement or privilege escalation depending on the employee’s assigned role and permissions.
Affected software
- Vendor: Roskus
- Product: Prospero Flow CRM
- Vulnerable versions: All versions 0 up to (but not including) 5.15.9
- Fixed version: 5.15.9 and later
Severity
- CVSS v4.0 Base Score: 9.3 (Critical)
- Vector:
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Mitigation and recommended actions
- Immediate: Upgrade Roskus Prospero Flow CRM to version 5.15.9 or later, which removes the hard-coded fallback password and instead generates a cryptographically random temporary credential (via
Str::random(32)), flags new accounts withmust_change_password, and sends employees a secure password-reset link instead of a default password. - Post-upgrade action: Audit all employee accounts created prior to patching and force a password reset for any account that may have been onboarded with the default
changemecredential, as upgrading alone does not invalidate previously set default passwords. - If immediate patching is not possible: Restrict network access to the CRM’s authentication endpoints to trusted networks/VPN only, enforce strong password policies and multi-factor authentication where supported, and monitor authentication logs for login attempts using the string
changemeor unusual login patterns against employee accounts.