This vulnerability (CVE-2026-19870) in Roskus Prospero Flow CRM prior to version 5.15.10 allows an authorization bypass via a user-controlled key in the payroll module. The flaw arises because the listing query for payroll data is not restricted to the user's company, and employee identifiers are validated only for global existence, not company membership. As a result, users with read payroll permission can access sensitive salary and banking information of employees from other companies, and users with create payroll permission can create payroll records for employees outside their company. The CVSS 4.0 score is 8.6, indicating high severity, with network attack vector, low attack complexity, no user interaction, and high impact on confidentiality and integrity.

The vulnerability allows unauthorized access to sensitive payroll information across company boundaries within the same CRM instance. Confidential salary and banking details can be viewed by users who should not have access, violating data confidentiality. Furthermore, unauthorized creation of payroll records for employees of other companies can compromise data integrity and potentially disrupt payroll processes.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch link is provided, users should monitor the vendor's communications for updates. Until a fix is available, restrict permissions for users with read or create payroll privileges to trusted personnel only and consider isolating company data instances if possible.