PT-2026-58931 · Unknown · Prospero Flow Crm

Gustavo Novaro + 2 · Published 2026-07-15 · Updated 2026-07-15 · CVE-2026-59235

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Prospero Flow CRM versions prior to 5.5.3

Description An authorization flaw exists in the BankAccountListController (app/Http/Controllers/Api/BankAccount/BankAccountListController.php) at the GET '/api/bank-account' endpoint. A remote, authenticated attacker with a low-privileged role, such as User, can read arbitrary bank account records belonging to their company. This occurs because the API route is protected only by the auth:api middleware and lacks a permission gate, unlike the web route which enforces the can('read bank') check. The handler uses Account::where('company id', Auth::user()->company id)->get(), which only applies company scoping without verifying the user's role or permissions. This leads to the unauthorized disclosure of sensitive banking data, including IBAN, SWIFT/BIC, and account identifiers.

Recommendations Update Prospero Flow CRM to version 5.5.3 or later. As a temporary mitigation, restrict access to the '/api/bank-account' endpoint to only authorized administrative roles.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-59235

Affected Products

Prospero Flow Crm

References · 5

• https://github.com/Roskus/prospero-flow-crm/commit/57bb57212af03151c989d67d6723d5ddb3e81e7b · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-59235 · Security Note
• https://github.com/Roskus/prospero-flow-crm/releases#release-v5.5.3 · Note
• https://twitter.com/CVEnew/status/2077362436106043461 · Twitter Post
• https://secur0.com/en/cna/cve-list/cve-2026-59235-missing-authorization-in-prospero-flow-crm-allows-low-privileged-users-to-read-all-bank-accounts · Note