Executive brief
Prospero Flow CRM is a customer relationship management (CRM) platform used to manage business transactions and accounting. A flaw in the transaction save endpoint allows users with legitimate transaction creation permissions to access sensitive financial data (bank account names, bank names, and card details) belonging to other companies by manipulating transaction parameters, risking unauthorized disclosure of confidential banking information.
Technical details
The vulnerability is an authorization bypass (CWE-639) in the POST /transaction/save endpoint. The application fails to validate that foreign key identifiers (bank_account_id and bank_card_id) belong to the user's own company before processing and persisting the transaction. A user with transaction and accounting creation permissions can supply a bank_account_id or bank_card_id from another company, causing the application to retrieve and render that company's sensitive banking details (account name, bank name, card last four digits) without proper ownership verification. The fix, released in version 5.14.1, adds company ownership validation for all foreign key references during transaction save operations. Network-accessible POST endpoint; requires authentication and transaction creation permissions.
Affected products
- Roskus Prospero Flow CRM 4.9.1 through 5.14.0
Timeline
- 2026-08-21: disclosed
- 2026-07-27: patched