Is CVE-2026-59235 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-59235 being exploited in the wild.

How severe is CVE-2026-59235?

Informational severity, with a CVSS score of 8.7, published 15 July 2026.

Which products and versions are affected?

Roskus Prospero Flow CRM >= 4.6.0, < 5.5.3.

Is there a fix for CVE-2026-59235?

A patch was published on 2026-06-22: Fix committed to repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-59235 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-59235?

Check whether you run Roskus Prospero Flow CRM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-59235: Roskus Prospero Flow CRM missing authorization in BankAccountListController

Q: Is there a fix for CVE-2026-59235?

A patch was published on 2026-06-22: Fix committed to repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-59235 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-59235?

Check whether you run Roskus Prospero Flow CRM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-59235 · Severity: info · CVSS 8.7 · Published 2026-07-15

Prospero Flow CRM, a customer relationship management platform, contains a security flaw in its bank account management interface. An employee or user with basic access can bypass intended restrictions to view sensitive corporate banking details, such as IBAN and SWIFT codes, that should be restricted to administrators or accounting staff. This could lead to the unauthorized exposure of a company's financial information to any internal user with a valid login.

Technologies: Roskus Prospero Flow CRM. Vendors: Roskus.

Quick answers

Is CVE-2026-59235 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-59235 being exploited in the wild.
How severe is CVE-2026-59235?: Informational severity, with a CVSS score of 8.7, published 15 July 2026.
Which products and versions are affected?: Roskus Prospero Flow CRM >= 4.6.0, < 5.5.3.
Is there a fix for CVE-2026-59235?: A patch was published on 2026-06-22: Fix committed to repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-59235 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-59235?: Check whether you run Roskus Prospero Flow CRM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A missing authorization vulnerability (CWE-862) exists in the `BankAccountListController` of Prospero Flow CRM. The API endpoint `GET /api/bank-account` was protected only by the `auth:api` middleware, which verifies authentication but fails to enforce specific permission gates (e.g., `read bank`). While the application correctly scopes data to the user's `company_id`, it does not perform role-based access control (RBAC) checks before returning the collection of bank accounts. An authenticated attacker with a low-privileged role (such as 'User') can retrieve sensitive banking data including IBAN and SWIFT/BIC codes. This issue was introduced after version 4.6.0 and is resolved in version 5.5.3.

Affected products

Roskus Prospero Flow CRM >= 4.6.0, < 5.5.3

Timeline

2026-06-22: patched: Fix committed to repository
2026-06-26: advisory: Version 5.5.3 released
2026-07-15: disclosed: CVE published by Secur0 CNA

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.