Missing Authorization Flaw in Prospero Flow CRM Exposes Sensitive Bank Account Data

CVE-2026-59235

What is CVE-2026-59235?

A missing authorization vulnerability exists in the BankAccountListController of Prospero Flow CRM, which affects versions earlier than 5.5.3. This flaw allows a remote, low-privileged attacker with a valid bearer token to exploit the API endpoint at /api/bank-account. The endpoint is inadequately secured, as it relies solely on auth:api middleware without enforcing additional permission checks, unlike the corresponding web route. Consequently, users with insufficient privileges can access sensitive bank account information, including IBAN and SWIFT/BIC codes, associated with their company, leading to unauthorized exposure of financial data.

References