CVE-2026-77759

IDOR and missing authorization in the Prospero Flow CRM transaction API allow cross-tenant reading of financial records

Published Aug 21, 2026 CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Description

Authorization Bypass Through User-Controlled Key in the transaction API in Roskus Prospero
Flow CRM 5.0.0 through 5.3.5 allows an authenticated user to read the transactions of other
companies on the same instance via an incremented identifier in GET /api/transaction/{id},
which is resolved without company scoping and without any permission check.

Analysis

Technical impact

The flaw is an IDOR that lets an authenticated user read transaction records of other companies using the /api/transaction/{id} endpoint. By incrementing or guessing the transaction ID, the API returns data without checking the user’s company or permission, exposing confidential financial records.

Affected Systems

Roskus Prospero Flow CRM versions 5.0.0 through 5.3.5 are affected. Any deployment of these releases in a multi‑tenant environment is vulnerable.

Risk and Exploitability

With a CVSS score of 8.7 the vulnerability is classified as high severity. Attackers only need valid credentials and can trigger the exploit through normal API traffic or crafted HTTP requests. The lack of an EPSS score or KEV listing does not lower the risk: the common web‑API interface and easy enumeration of transaction IDs make exploitation practical for an attacker with an account.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Roskus

Prospero Flow CRM

unaffected

Version	Status	Constraints
`5.0.0`	affected	< 5.3.6

No data.

Vendor Product Versions

Roskus

Prospero Flow Crm

Version	Status	Scheme	Platform
`[5.0.0,5.3.6)`	affected	semver	—

Remediation

Vendor Solution

Upgrade to 5.3.6 or later. The fix was not tagged; the first tagged release carrying it is v5.5.3.

OpenCVE Recommended Actions

Upgrade to Roskus Prospero Flow CRM v5.5.3 or any later release that includes the fix
Configure the system or API gateway to enforce company‑scoped validation of transaction IDs, preventing unauthorized cross‑tenant access
Limit API access to trusted IP ranges or authenticated roles and review permissions to ensure users have only the necessary rights to interact with transaction data

Generated by OpenCVE AI on August 21, 2026 at 12:39 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.509% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://github.com/Roskus/prospero-flow-crm/commit/980c35ac00e419591a8adc2d1dbcc120ea62e273
https://github.com/Roskus/prospero-flow-crm/releases/tag/v5.5.3
https://secur0.com/en/cna/cve-list/cve-2026-77759-idor-missing-authz-prospero-transaction-api

History

Aug 21, 2026 12:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Aug 21, 2026 11:45 AM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Authorization Bypass Through User-Controlled Key in the transaction API in Roskus Prospero Flow CRM 5.0.0 through 5.3.5 allows an authenticated user to read the transactions of other companies on the same instance via an incremented identifier in GET /api/transaction/{id}, which is resolved without company scoping and without any permission check.
Title		IDOR and missing authorization in the Prospero Flow CRM transaction API allow cross-tenant reading of financial records
First Time appeared		Roskus Roskus prospero Flow Crm
Weaknesses		CWE-639
CPEs		cpe:2.3:a:roskus:prospero_flow_crm::::::::
Vendors & Products		Roskus Roskus prospero Flow Crm
References		https://github.com/Roskus/prospero-flow-crm/commit/980c35ac00e419591a8adc2d1dbcc120ea62e273 https://github.com/Roskus/prospero-flow-crm/releases/tag/v5.5.3 https://secur0.com/en/cna/cve-list/cve-2026-77759-idor-missing-authz-prospero-transaction-api
Metrics		cvssV4_0 `{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}`