CVE-2026-59235 – Missing authorization in Prospero Flow CRM allows low-privileged users to read all bank accounts

CVE ID :CVE-2026-59235

Published : July 15, 2026, 11:16 a.m. | 16 minutes ago

Description :Missing Authorization (CWE-862) in BankAccountListController (app/Http/Controllers/Api/BankAccount/BankAccountListController.php), exposed at GET /api/bank-account, in Prospero Flow CRM company_id)->get(), performing only company scoping and no role or permission check before returning the data. This results in the unauthorized disclosure of sensitive banking information (e.g. IBAN, SWIFT/BIC, account identifiers) to users who should not have access to it.

Severity: 8.7 | HIGH

Visit the link for more details, such as CVSS details, affected products, timeline, and more…