CVE-2026-19870

This vulnerability creates a dangerous inversion: the organizations most compliant with security best practices are the most exposed. The flaw lies in how Roskus Prospero Flow CRM validates access. The system checks that a user holds payroll permissions and that an employee ID exists, then queries payroll data without enforcing that the user and the data belong to the same company. Tenant membership is never validated as a first-class constraint—it's simply absent from the query. A user granted 'read payroll' access for their own company can, with this flaw, read salary and banking details for every company in the instance. The permission works exactly as designed; the design is the problem. What makes this particularly insidious is that the access pattern is indistinguishable from legitimate usage—both in logs and in any anomaly detection you might have in place. A user querying payroll records for employee IDs across multiple tenants looks like a user querying payroll records, period. Start by auditing who holds payroll permissions across your instance. Each of those users represents a potential cross-tenant access vector. Next, examine whether employee identifiers are sequential or predictable—if they are, enumeration of other tenants' workers is feasible, dramatically expanding the blast radius. The payroll module likely isn't the only place this pattern exists; any module that needed a 'global employee lookup' for convenience probably carries the same failure. Check time tracking, employee directories, and org chart features for the same missing tenant constraint. Finally, consider whether payroll operations trigger notifications (emails, webhooks, Slack messages) to the legitimate company—if so, exploitation would require active concealment. The CVSS score understates the realistic impact because salary and banking details create downstream fraud vectors that extend well beyond data exposure into payroll diversion and wire transfer spoofing.

Reviewed through automated stages and approved by a human before publication.