CVE-2026-77780
Received Received - Intake

Authorization Bypass in Prospero Flow CRM

Publication date: 2026-08-21

Last updated on: 2026-08-21

Assigner: Secur0

Description
Authorization Bypass Through User-Controlled Key in the transaction save endpoint in Roskus Prospero Flow CRM 4.9.1 through 5.14.0 allows a user with transaction and accounting creation permissions to disclose another company's bank account name, bank name and card last four digits via a bank_account_id or bank_card_id belonging to that company in POST /transaction/save, which is persisted and rendered without any company ownership check.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-21
Last Modified
2026-08-21
Generated
2026-08-21
AI Q&A
2026-08-21
EPSS Evaluated
N/A
NVD
CVE-2026-77780
EUVD
EUVD-2026-63935

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
roskus prospero_flow_crm From 4.9.1 (inc) to 5.14.0 (inc)
roskus prospero_flow_crm 5.14.1
roskus prospero_flow_crm 5.14.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an authorization bypass vulnerability in Prospero Flow CRM versions 4.9.1 through 5.14.0. It allows users with transaction and accounting permissions to access another company's bank account name, bank name, and card last four digits by manipulating bank_account_id or bank_card_id parameters in the transaction save endpoint. The issue occurs because the system fails to verify company ownership for these foreign keys.

Detection Guidance

Check for unauthorized transactions linked to bank accounts or cards not owned by the authenticated user. Review logs for POST requests to /transaction/save with bank_account_id or bank_card_id parameters. Verify if banking details appear in accounting lists for users without proper access.

Impact Analysis

An attacker with transaction and accounting permissions could view sensitive banking details of other companies without their knowledge. This could lead to financial fraud, data breaches, or unauthorized transactions if combined with other vulnerabilities. The impact is limited to users with specific permissions in affected versions.

Compliance Impact

This vulnerability could violate data protection regulations like GDPR and HIPAA by enabling unauthorized access to sensitive financial data across tenants. It undermines principles of data minimization, access control, and cross-tenant isolation required by these standards.

Mitigation Strategies

Upgrade Prospero Flow CRM to version 5.14.2 or later. If upgrading is not possible, review existing transactions for mislinked bank accounts or cards and remove unauthorized links. Implement additional validation checks for foreign key ownership in transaction endpoints.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-77780. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart