This vulnerability (CVE-2026-19870) in Roskus Prospero Flow CRM before version 5.15.10 allows an authorization bypass through a user-controlled key. The payroll module fails to restrict access to employee data and payroll record creation by scoping queries and validations only to the authenticated user's company. As a result, users with certain payroll permissions can access or manipulate payroll data across company boundaries within the same CRM instance. The issue is classified under CWE-639 (Authorization Bypass Through User-Controlled Key).

The vulnerability enables unauthorized access to sensitive payroll information such as salary and banking details of employees from other companies sharing the same CRM instance. It also allows unauthorized creation of payroll records for employees of other companies. This could lead to data leakage, privacy violations, and potential financial fraud or manipulation within affected organizations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict payroll module permissions to trusted users only and monitor for suspicious activity related to payroll data access or creation. Avoid granting read or create payroll permissions broadly within the CRM instance.