The flaw is an authorization bypass through a user-controlled key in the transaction save endpoint. A user with permissions to create transactions can supply a bank_account_id or bank_card_id that belongs to another company. The system then persists and renders bank account name, bank name, and the last four digits of the card without verifying tenancy. This allows disclosure of banking identifiers across tenants, as exemplified by the vulnerability classified as CWE-639.

Roskus Prospero Flow CRM versions 4.9.1 through 5.14.0 are affected. These versions lack an ownership check when processing POST /transaction/save and use foreign keys that can reference bank accounts or cards from other companies.

The vulnerability has a CVSS score of 5.3, indicating moderate impact. The EPSS score is not available, so precise exploitation probability is unknown. The flaw is not listed in CISA KEV. The likely attack vector is an authenticated user sending a crafted POST /transaction/save request with a foreign key belonging to another tenant. The attack requires existing transaction and accounting creation privileges but otherwise is straightforward due to the missing ownership validation.