CVE-2026-19870
HighCVSS 8.6Summary
In the payroll module in Roskus Prospero Flow CRM before 5.15.10, an authorization bypass through user-controlled key vulnerability exists. Authenticated users holding the read payroll permission can view salary and banking details of employees of any other company in the instance, and users holding the create payroll permission can create payroll records attributed to another company's employees, because the listing query is not scoped to the caller's company and the employee identifier is validated for global existence rather than company membership.
Risk Assessment
An authenticated user can access sensitive payroll data of other companies, violating privacy and potentially leading to data leakage. They can also create fraudulent payroll records, potentially leading to financial fraud.
Recommendation
Upgrade Roskus Prospero Flow CRM to version 5.15.10 or later, which fixes the issue. Also regularly review user permissions and restrict access to the payroll module.
Original NVD description (English source)
Authorization Bypass Through User-Controlled Key in the payroll module in Roskus Prospero Flow CRM before 5.15.10 allows authenticated users holding the read payroll permission to view the salary and banking details of employees of any other company in the instance, and users holding the create payroll permission to create payroll records attributed to another company's employees, because the listing query is not scoped to the caller's company and the employee identifier is validated for global existence rather than company membership