Authorization Bypass in Roskus Prospero Flow CRM Payroll Module

Executive Summary

CVE-2026-19870 is an Insecure Direct Object Reference (IDOR) vulnerability in Roskus Prospero Flow CRM's payroll module affecting versions before 5.15.10. It allows authenticated users with specific permissions to bypass authorization checks and access or create payroll records belonging to other companies within the same CRM instance. The flaw stems from missing company-based scoping in payroll queries and insufficient validation of employee IDs.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your Prospero Flow CRM version is 5.15.9 or earlier. Inspect the payroll module endpoints GET /payroll and POST /payroll/save for improper authorization checks. Look for unauthorized access to payroll records across different companies.

Useful 0 Not Useful 0

Impact Analysis

An attacker with 'read payroll' permissions could view sensitive salary and banking details of employees from other companies, including IBAN numbers and payment dates. With 'create payroll' permissions, they could fabricate fake payroll records attributed to employees of other companies, which would appear legitimate in the victim company's payroll listing.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates data protection regulations such as GDPR (due to unauthorized access to personal and financial data) and HIPAA (if payroll data includes protected health information). It enables cross-tenant data exposure, creating significant compliance risks related to unauthorized data access and potential breaches of confidentiality requirements.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade Prospero Flow CRM to version 5.15.10 or later. Ensure the payroll module enforces company-specific access controls. Review payroll records for unauthorized entries created by attackers.

Useful 0 Not Useful 0