CVE-2026-19870 in Prospero Flow CRM
Summary
by MITRE • 08/14/2026
Authorization Bypass Through User-Controlled Key in the payroll module in Roskus Prospero Flow CRM before 5.15.10 allows authenticated users holding the read payroll permission to view the salary and banking details of employees of any other company in the instance, and users holding the create payroll permission to create payroll records attributed to another company's employees, because the listing query is not scoped to the caller's company and the employee identifier is validated for global existence rather than company membership
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/14/2026
This vulnerability represents a critical authorization bypass flaw in the Roskus Prospero Flow CRM payroll module affecting versions prior to 5.15.10. The issue stems from inadequate access control mechanisms that fail to properly scope data queries based on the authenticated user's company affiliation. The root cause lies in how the system handles user-controlled keys during payroll operations, specifically when validating employee identifiers against company boundaries. When users with read payroll permissions attempt to access salary and banking details, the system does not enforce company-level restrictions during query execution, allowing unauthorized cross-company data access. Similarly, users with create payroll permissions can manipulate employee identifiers to generate payroll records attributed to employees from other companies within the same instance, completely bypassing intended security boundaries.
The technical implementation flaw manifests in two distinct attack vectors that exploit weak input validation and insufficient query scoping mechanisms. The system performs global existence checks for employee identifiers rather than company-specific membership validation, enabling attackers to reference employees across different organizations. This design weakness creates a scenario where the payroll module's data retrieval functions do not properly filter results based on the authenticated user's company context, resulting in information disclosure of sensitive financial data including salary details and banking information. The vulnerability also affects write operations, allowing malicious actors to create fraudulent payroll records that appear to belong to employees from other companies, potentially leading to financial fraud or data manipulation.
From an operational impact perspective, this authorization bypass compromises the fundamental principle of data isolation within multi-tenant CRM environments. Organizations using Roskus Prospero Flow CRM face significant risks including unauthorized access to competitors' salary information, potential financial fraud through payroll manipulation, and violation of data privacy regulations such as gdpr and ccpa. The vulnerability particularly affects companies with multiple subsidiaries or clients sharing the same CRM instance, where proper data segmentation is crucial for maintaining business confidentiality and regulatory compliance. Security incidents resulting from this flaw could lead to severe reputational damage, legal consequences, and financial losses due to unauthorized payroll processing.
The vulnerability aligns with several cybersecurity frameworks and threat models, including cwe-284 which addresses improper access control, and attack techniques described in the attack tree framework under privilege escalation and data exposure categories. Organizations should implement immediate mitigations including patching to version 5.15.10 or later, enforcing proper company scoping in all payroll queries, and implementing additional validation checks for employee identifiers. Security controls should include mandatory company context validation during payroll operations, enhanced audit logging of payroll activities, and regular access control reviews to ensure proper segregation of duties. Organizations must also consider implementing network segmentation and database-level access controls as additional defensive measures to limit the impact of potential exploitation attempts.