Which versions of PHP are affected by CVE-2026-59235?

Prospero Flow CRM before version 5.5.3 contains an authorization flaw allowing any employee with valid system credentials to access all company banking records and financial account details through…. A patch is available.

How to fix or mitigate CVE-2026-59235?

Within 24 hours, identify all Prospero Flow CRM deployments and confirm which are running versions before 5.5.3; obtain the 5.5.3 patch from the vendor immediately. Within 7 days, complete deployment of Prospero Flow CRM 5.5.3 across all instances, then validate that the /api/bank-account endpoint now enforces authorization controls consistent with the web interface. Within 30 days, audit Prospero Flow CRM API access logs from all dates when vulnerable versions were in use to identify any unauthorized /api/bank-account queries; escalate findings to legal and compliance for regulatory notification assessment.

PHP CVE-2026-59235

Q: What is the CVSS score of CVE-2026-59235?

CVE-2026-59235 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-44608 HIGH

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-07-15 Secur0

GHSA-74w5-9874-x8hw

PHP Authentication Bypass Prospero Flow Crm Roskus

8.7

CVSS 4.0 · Vendor: Secur0

Severity by source

Vendor (Secur0) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (Secur0) · only source for this CVE.

CVSS VectorVendor: Secur0

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 15, 2026 - 11:16 vuln.today

Analysis Generated

Jul 15, 2026 - 11:16 vuln.today

CVE Published

Jul 15, 2026 - 10:38 cve.org

HIGH 8.7

DescriptionCVE.org

Missing Authorization (CWE-862) in BankAccountListController (app/Http/Controllers/Api/BankAccount/BankAccountListController.php), exposed at GET /api/bank-account, in Prospero Flow CRM <5.5.3, which allows a remote, authenticated attacker holding a low-privileged role (e.g. the "User"/"Usuario" role) to read arbitrary bank account records belonging to their company by sending an authenticated request to the endpoint with a valid bearer token, because the API route is protected only by the auth:api middleware and carries no permission gate, unlike the equivalent web route, which enforces can('read bank'), and the handler resolves records with Account::where('company_id', Auth::user()->company_id)->get(), performing only company scoping and no role or permission check before returning the data. This results in the unauthorized disclosure of sensitive banking information (e.g. IBAN, SWIFT/BIC, account identifiers) to users who should not have access to it.

AnalysisAI

Broken function-level authorization in Prospero Flow CRM before 5.5.3 lets any authenticated low-privileged user (e.g. the standard 'User'/'Usuario' role) read every bank account record belonging to their company via GET /api/bank-account. The API route is guarded only by auth:api with no permission gate — unlike the web equivalent, which enforces can('read bank') — so any valid bearer token returns sensitive banking data (IBAN, SWIFT/BIC, account identifiers). A vendor patch exists (5.5.3) and the fixing commit is public; there is no public exploit identified at time of analysis and the flaw is not in CISA KEV.