CVE-2026-59235 Roskus CVE debrief

Who should care

Defenders responsible for Prospero Flow CRM deployments, particularly those with low-privileged users, should assess exposure and prioritize remediation to prevent unauthorized disclosure of sensitive banking information.

Why it matters

CVE-2026-59235 is a Missing Authorization vulnerability in Prospero Flow CRM that allows low-privileged users to read arbitrary bank account records. Defenders should prioritize verifying exposure and applying patches or compensating controls to restrict access to sensitive banking information. The vulnerability affects versions prior to 5.5.3 and has a CVSS score of 8.7.

• Potential unauthorized disclosure of sensitive banking information, such as IBAN, SWIFT/BIC, and account identifiers
• Possible lateral movement or escalation of privileges by low-privileged users
• Need for verification of exposure and application of patches or compensating controls
• Potential impact on compliance with data protection regulations

Technical summary

The vulnerability exists in BankAccountListController, exposed at GET /api/bank-account, in Prospero Flow CRM versions prior to 5.5.3. The API route is protected only by the auth:api middleware and carries no permission gate, unlike the equivalent web route, which enforces can('read bank'). This allows low-privileged users to read arbitrary bank account records belonging to their company by sending an authenticated request to the endpoint with a valid bearer token. The handler resolves records with Account::where('company_id', Auth::user()->company_id)->get(), performing only company scoping and no role or permission check before returning the data.

Defensive priority

Defenders should prioritize verifying exposure and applying patches or compensating controls to restrict access to sensitive banking information.

Recommended defensive actions

• Verify exposure by checking if the affected endpoint is accessible to low-privileged users
• Apply patches or updates to Prospero Flow CRM to address the vulnerability
• Implement compensating controls, such as restricting access to sensitive banking information
• Monitor for suspicious activity related to bank account records
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected versions. Additional information is available from source references, including GitHub commits and release notes.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.