The vulnerability is a missing authorization check in Prospero Flow CRM’s BankAccountListController. The GET /api/bank-account endpoint is protected only by generic authentication middleware and lacks a permission gate that would restrict read access. Consequently, an authenticated user with a low‑privileged role within their own company can retrieve all bank account records for their company, exposing sensitive information such as IBAN, SWIFT/BIC, and account identifiers. This flaw is defined by missing authorization (CWE‑639).

Roskus’s Prospero Flow CRM versions earlier than 5.5.3, specifically the BankAccountListController handling requests to /api/bank-account, which is triggered by authenticated users with a low‑privileged role.

The CVSS score of 8.7 indicates high severity, while the EPSS score of less than 1% denotes a low current exploitation probability. The vulnerability is not listed in CISA KEV. Exploitation requires a remote authenticated attacker holding a low‑privileged bearer token; by performing a straightforward GET request to the endpoint, the attacker can obtain the full set of bank account records for their company.