Roskus Prospero Flow CRM up to 5.5.2 BankAccountListController BankAccountListController.php get company_id authorization

Summaryinfo

A vulnerability was found in Roskus Prospero Flow CRM up to 5.5.2. It has been rated as problematic. This affects the function get of the file app/Http/Controllers/Api/BankAccount/BankAccountListController.php of the component BankAccountListController. The manipulation of the argument company_id leads to authorization. This vulnerability is documented as CVE-2026-59235. The attack can be initiated remotely. There is not any exploit available.

Detailsinfo

A vulnerability was found in Roskus Prospero Flow CRM up to 5.5.2 and classified as problematic. This issue affects the function get of the file app/Http/Controllers/Api/BankAccount/BankAccountListController.php of the component BankAccountListController. The manipulation of the argument company_id with an unknown input leads to a authorization vulnerability. Using CWE to declare the problem leads to CWE-862. The product does not perform an authorization check when an actor attempts to access a resource or perform an action. Impacted is confidentiality. The summary by CVE is:

Missing Authorization (CWE-862) in BankAccountListController (app/Http/Controllers/Api/BankAccount/BankAccountListController.php), exposed at GET /api/bank-account, in Prospero Flow CRM <5.5.3, which allows a remote, authenticated attacker holding a low-privileged role (e.g. the "User"/"Usuario" role) to read arbitrary bank account records belonging to their company by sending an authenticated request to the endpoint with a valid bearer token, because the API route is protected only by the auth:api middleware and carries no permission gate, unlike the equivalent web route, which enforces can('read bank'), and the handler resolves records with Account::where('company_id', Auth::user()->company_id)->get(), performing only company scoping and no role or permission check before returning the data. This results in the unauthorized disclosure of sensitive banking information (e.g. IBAN, SWIFT/BIC, account identifiers) to users who should not have access to it.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2026-59235 since 07/03/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details of the vulnerability are known, but there is no available exploit.

By approaching the search of inurl:app/Http/Controllers/Api/BankAccount/BankAccountListController.php it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 5.5.3 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Customer Relationship Management System

Vendor

• Roskus

Name

• Prospero Flow CRM

Version

• 5.5.0
• 5.5.1
• 5.5.2

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion