The flaw is an IDOR that lets an authenticated user read transaction records of other companies using the /api/transaction/{id} endpoint. By incrementing or guessing the transaction ID, the API returns data without checking the user’s company or permission, exposing confidential financial records.

Roskus Prospero Flow CRM versions 5.0.0 through 5.3.5 are affected. Any deployment of these releases in a multi‑tenant environment is vulnerable.

With a CVSS score of 8.7 the vulnerability is classified as high severity. Attackers only need valid credentials and can trigger the exploit through normal API traffic or crafted HTTP requests. The lack of an EPSS score or KEV listing does not lower the risk: the common web‑API interface and easy enumeration of transaction IDs make exploitation practical for an attacker with an account.