CVE-2026-77759
Received Received - Intake

Authorization Bypass in Roskus Prospero Flow CRM

Publication date: 2026-08-21

Last updated on: 2026-08-21

Assigner: Secur0

Description
Authorization Bypass Through User-Controlled Key in the transaction API in Roskus Prospero Flow CRM 5.0.0 through 5.3.5 allows an authenticated user to read the transactions of other companies on the same instance via an incremented identifier in GET /api/transaction/{id}, which is resolved without company scoping and without any permission check.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-21
Last Modified
2026-08-21
Generated
2026-08-21
AI Q&A
2026-08-21
EPSS Evaluated
N/A
NVD
CVE-2026-77759
EUVD
EUVD-2026-63906

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
roskus prospero_flow_crm to 5.3.5 (inc)
roskus prospero_flow_crm 5.3.6
roskus prospero_flow_crm 5.5.3

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an Authorization Bypass Through User-Controlled Key in the transaction API of Roskus Prospero Flow CRM versions 5.0.0 through 5.3.5. It allows authenticated users to read transactions belonging to other companies on the same instance by manipulating an incremented identifier in the GET /api/transaction/{id} endpoint. The system fails to scope transactions by company_id or enforce proper permission checks, enabling unauthorized access to sensitive financial data.

Detection Guidance

Check for unauthorized access to GET /api/transaction/{id} endpoints by monitoring logs for requests with incremented IDs. Look for transactions accessed outside the user's company scope. Use tools like curl to test endpoints: curl -X GET http://<target>/api/transaction/<id> and verify if responses include data from other companies.

Impact Analysis

This vulnerability allows attackers to access sensitive financial records of other companies, including names, transaction types, amounts, statuses, and dates. Since transaction IDs are predictable, attackers can enumerate all records, leading to data breaches, financial fraud, or compliance violations. The impact includes unauthorized data exposure and potential misuse of financial information.

Compliance Impact

This vulnerability can lead to non-compliance with GDPR and HIPAA due to unauthorized access to sensitive personal and financial data. GDPR requires strict data protection and user consent, while HIPAA mandates safeguards for protected health information. A breach could result in legal penalties, fines, and reputational damage for organizations using the affected CRM software.

Mitigation Strategies

Upgrade Prospero Flow CRM to version 5.3.6 or later to apply the IDOR protection and permission checks. If upgrading is not immediately possible, restrict access to the /api/transaction/{id} endpoint via network-level controls or disable it temporarily until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-77759. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart