Threats Tagged 'cve-2026-19870'

An authorization bypass vulnerability exists in the payroll module of Roskus Prospero Flow CRM versions before 5.15.10. Authenticated users with read payroll permission can view salary and banking details of employees from other companies within the same instance. Additionally, users with create payroll permission can create payroll records for employees of other companies. This occurs because the query listing is not properly scoped to the caller's company, and employee identifiers are validated only for global existence rather than company membership.

CVE-2026-19870 is an authorization bypass vulnerability in the payroll module of Roskus Prospero Flow CRM versions before 5.15.10. Authenticated users with read payroll permission can view salary and banking details of employees from other companies within the same instance. Additionally, users with create payroll permission can create payroll records for employees of other companies. This occurs because the system does not properly scope queries to the caller's company and validates employee identifiers only for global existence rather than company membership.