CVE-2026-59235 is an authorization bypass vulnerability (CWE-639) in Prospero Flow CRM's BankAccountListController (app/Http/Controllers/Api/BankAccount/BankAccountListController.php) affecting versions 4.6.0 through before 5.5.3. The GET /api/bank-account endpoint is protected solely by auth:api middleware without enforcing permission checks like can('read bank'), unlike the web route counterpart. The controller filters bank account records only by company_id matching the authenticated user's company, but does not verify the user's role or permissions, allowing low-privileged authenticated users to read arbitrary bank account data belonging to their company. This results in unauthorized disclosure of sensitive banking details.

An attacker with any authenticated low-privileged user role can retrieve sensitive bank account information (e.g., IBAN, SWIFT/BIC, account identifiers) of their company without proper authorization. This unauthorized data exposure can lead to privacy violations and potential financial risks for the affected company. The vulnerability does not require privilege escalation or user interaction beyond authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict API access to trusted users only and monitor for unusual access patterns. Implement additional permission checks on the /api/bank-account endpoint to enforce role-based access control equivalent to the web route's can('read bank') permission gate.