Skip to content
CVE PROGRAM SOURCE RECORD8.7 High

CVE-2026-59235

Missing authorization in Prospero Flow CRM allows low-privileged users to read all bank accounts

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Secur0

Description

Missing Authorization (CWE-862) in BankAccountListController (app/Http/Controllers/Api/BankAccount/BankAccountListController.php), exposed at GET /api/bank-account, in Prospero Flow CRM <5.5.3, which allows a remote, authenticated attacker holding a low-privileged role (e.g. the "User"/"Usuario" role) to read arbitrary bank account records belonging to their company by sending an authenticated request to the endpoint with a valid bearer token, because the API route is protected only by the auth:api middleware and carries no permission gate, unlike the equivalent web route, which enforces can('read bank'), and the handler resolves records with Account::where('company_id', Auth::user()->company_id)->get(), performing only company scoping and no role or permission check before returning the data. This results in the unauthorized disclosure of sensitive banking information (e.g. IBAN, SWIFT/BIC, account identifiers) to users who should not have access to it.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Roskus Prospero Flow CRM

Default version status: unaffected

  • 4.6.0 to < 5.5.3affected

References