CVE-2026-59235: Prospero Flow CRM Information Disclosure

CVE-2026-59235 Overview

CVE-2026-59235 is a Missing Authorization vulnerability [CWE-862] in Prospero Flow CRM versions prior to 5.5.3. The flaw resides in BankAccountListController at app/Http/Controllers/Api/BankAccount/BankAccountListController.php, exposed via GET /api/bank-account. The API route is protected only by the auth:api middleware and enforces no permission gate. A remote, authenticated attacker holding a low-privileged role (such as User/Usuario) can read arbitrary bank account records belonging to their company. This exposes sensitive banking information including IBAN, SWIFT/BIC codes, and account identifiers to users who should not have access.

Critical Impact
Any authenticated low-privileged user can enumerate all company bank accounts through a single API call, resulting in unauthorized disclosure of financial identifiers.

Affected Products

Prospero Flow CRM versions prior to 5.5.3
BankAccountListController component (app/Http/Controllers/Api/BankAccount/BankAccountListController.php)
API endpoint GET /api/bank-account

Discovery Timeline

2026-07-15 - CVE-2026-59235 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-59235

Vulnerability Analysis

The vulnerability stems from inconsistent authorization enforcement between the web and API routes for bank account listing. The web route enforces the can('read bank') permission gate. The equivalent API route relies solely on the auth:api middleware and performs no role or permission check. Any valid bearer token grants access to the endpoint regardless of the user's assigned role.

The request handler resolves records using Account::where('company_id', Auth::user()->company_id)->get(). This query performs only company scoping. It returns every bank account associated with the caller's company. Users assigned low-privileged roles such as Usuario can therefore retrieve full bank account records including IBAN, SWIFT/BIC, and account identifiers.

Root Cause

The root cause is a missing authorization check in the API controller. The developers implemented a permission gate on the web-facing route but did not replicate it on the API route. This inconsistency creates a horizontal and vertical access control gap on a sensitive financial data endpoint.

Attack Vector

Exploitation requires network access to the API and a valid bearer token for any authenticated account in the target company. The attacker issues a single GET /api/bank-account request. The server returns the full list of company bank accounts without checking the caller's role or permissions.

php

// Security patch: import FormRequest class to enforce authorization
namespace App\Http\Controllers\Api\BankAccount;

+use App\Http\Requests\BankAccountListRequest;
 use App\Models\Bank\Account;
 use Illuminate\Http\JsonResponse;
 use Illuminate\Support\Facades\Auth;

Source: GitHub Commit 57bb572

The patch replaces the generic Illuminate\Http\Request with a dedicated BankAccountListRequest FormRequest. Laravel FormRequests execute an authorize() method before the controller action runs, providing the missing permission gate.

Detection Methods for CVE-2026-59235

Indicators of Compromise

Unexpected GET /api/bank-account requests originating from user accounts assigned the User/Usuario role.
API access logs showing bank account endpoint calls from bearer tokens tied to non-administrative accounts.
Bulk retrieval of bank account JSON responses to a single IP address within a short time window.

Detection Strategies

Correlate authenticated API traffic with the caller's assigned role and flag /api/bank-account accesses by users without the read bank permission.
Baseline normal callers of the endpoint and alert on new user identifiers or tokens accessing it.
Parse Laravel application logs for BankAccountListController invocations and cross-reference with the roles service.

Monitoring Recommendations

Enable verbose request logging on all /api/bank-account* routes and forward to a centralized SIEM.
Monitor outbound API responses for financial identifier patterns such as IBAN and SWIFT/BIC to detect exfiltration.
Track authentication events for low-privileged accounts to identify token abuse or credential compromise.

How to Mitigate CVE-2026-59235

Immediate Actions Required

Upgrade Prospero Flow CRM to version 5.5.3 or later, which applies the authorization patch.
Audit application logs for prior unauthorized access to /api/bank-account and identify potentially exposed bank account records.
Rotate any bank account credentials or notify counterparties if unauthorized reads are confirmed.
Review role assignments and revoke API tokens for accounts that do not require bank data access.

Patch Information

The fix is delivered in Prospero Flow CRM v5.5.3. The change is committed in GitHub commit 57bb572, which introduces BankAccountListRequest and BankAccountCreateRequest FormRequest classes to enforce authorization on the API controllers. See the CVE-2026-59235 Security Advisory for further details.

Workarounds

Restrict /api/bank-account at the reverse proxy or web application firewall (WAF) layer to trusted administrator source addresses until the patch is applied.
Add a manual permission check inside BankAccountListController that calls Auth::user()->can('read bank') and returns HTTP 403 when the check fails.
Temporarily disable the API route in routes/api.php if administrative users only require the web UI.

bash

# Example nginx block restricting the vulnerable endpoint
location /api/bank-account {
    allow 10.0.0.0/24;   # admin subnet
    deny all;
    proxy_pass http://prospero-backend;
}