The vulnerability is an IDOR in the payroll module that permits an authenticated user with read or create permissions to access or manipulate payroll data belonging to employees in other tenant companies. The flaw lies in the listing query not filtering by the caller’s company and in the validation that accepts any globally existing employee identifier. This allows a user to view confidential salary and banking information and to create payroll records that are attributed to employees of other organizations. The impact constitutes a confidentiality breach and potential integrity violation, affecting all employees in the instance and exposing sensitive financial data.

Roskus Prospero Flow CRM versions prior to 5.15.10 are affected. The vulnerability was discovered in the payroll module of the open‑source product "Prospero Flow CRM" hosted by Roskus. Anyone running an instance of this software without upgrading to the patched release is susceptible. The fix is distributed as an untagged commit, so a manual application of the change may be required if the environment does not use the released version.

The flaw carries a CVSS score of 8.6, indicating a high severity. EPSS data is not available, but the lack of a public exploit does not reduce the risk because the deficiency can be exploited by any internal user who holds the requisite payroll permissions. The vulnerability is not listed in the CISA KEV catalog. The most likely attack vector is an authenticated request to the payroll endpoints where the user supplies an employee identifier that does not belong to their own company. Once activated, the attacker can read or create payroll data for arbitrary employees across all companies hosted in the same instance.