IDOR in Prospero Flow CRM allows cross-tenant payroll disclosure and creation

Description

Authorization Bypass Through User-Controlled Key (CWE-639) and Missing Authorization (CWE-862) in the payroll module (PayrollIndexController and PayrollRequest), exposed at GET /payroll and POST /payroll/save, in Prospero Flow CRM 5.15.9, which allow an authenticated user holding the read payroll permission to view the payroll records of employees of any other company in the instance (gross amount, net amount, IBAN, payment date and notes) and, holding the create payroll permission, to create payroll records attributed to another company's employees, because the listing's base query was built as Payroll::where('period_year', $year) with no company constraint, the whereHas filter on company_id being applied only inside the conditional branch that runs when filtering by a specific employee, so loading the listing without filters returned records from every company, and because PayrollRequest validated the user_id field with the exists:user,id rule, which checks the identifier's global existence rather than its membership of the authenticated user's company, unlike the rest of the project's modules, which consistently scope their queries by company_id. This results in disclosure of the salary and banking details of employees outside the attacker's organization, and in the insertion of fabricated payroll records that appear in the victim company's own listing indistinguishable from legitimate ones.

Vulnerability type (CWE)

CWE-639: Authorization Bypass Through User-Controlled Key

CWE-862: Missing Authorization

Affected versions

Prospero Flow CRM before 5.15.10 (fixed in 5.15.10 by commit 59644f91, dated 2026-07-28). The payroll module was introduced in commit 5804831d (2024-02-12), at version 3.7.2, and the flaw was present in the v4.6.0, v5.5.3 and v5.14.0 tags, so tagged releases did ship in a vulnerable state. Versions are read from the APP_VERSION constant in version.php. Default status: unaffected.

Score (CVSS 4.0)

High (8.6)

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Solution

Upgrade to version 5.15.10 or higher. The fix is not included in any tagged release: the repository's latest tag is v5.14.0, which predates it.

Patch

Commit 59644f91

Credits

• Manuel Martínez Casasola - finder
• Cristian Fernández Cornejo - analyst
• Xoán M. Otero Jorge - analyst
• Secur0 CNA - coordinator
• Gustavo Novaro - remediation developer Discovery source: External Official record: CVE-2026-19870