CVE-2026-19870

Name of the Vulnerable Software and Affected Versions Roskus Prospero Flow CRM versions prior to 5.15.10

Description An authorization bypass exists in the payroll module where the listing query is not scoped to the caller's company and the employee identifier is validated for global existence rather than company membership. This allows authenticated users with read payroll permissions to view salary and banking details of employees from any other company within the instance. Additionally, users with create payroll permissions can create payroll records attributed to employees of other companies.

Recommendations Update Roskus Prospero Flow CRM to version 5.15.10 or later.