Executive brief
Prospero Flow CRM, a customer relationship management platform, contains a security flaw in its bank account management interface. An employee or user with basic access can bypass intended restrictions to view sensitive corporate banking details, such as IBAN and SWIFT codes, that should be restricted to administrators or accounting staff. This could lead to the unauthorized exposure of a company's financial information to any internal user with a valid login.
Technical details
A missing authorization vulnerability (CWE-862) exists in the `BankAccountListController` of Prospero Flow CRM. The API endpoint `GET /api/bank-account` was protected only by the `auth:api` middleware, which verifies authentication but fails to enforce specific permission gates (e.g., `read bank`). While the application correctly scopes data to the user's `company_id`, it does not perform role-based access control (RBAC) checks before returning the collection of bank accounts. An authenticated attacker with a low-privileged role (such as 'User') can retrieve sensitive banking data including IBAN and SWIFT/BIC codes. This issue was introduced after version 4.6.0 and is resolved in version 5.5.3.
Affected products
- Roskus Prospero Flow CRM >= 4.6.0, < 5.5.3
Timeline
- 2026-06-22: patched: Fix committed to repository
- 2026-06-26: advisory: Version 5.5.3 released
- 2026-07-15: disclosed: CVE published by Secur0 CNA