HIGH 8.7 NVD
CVE-2026-77759
Authorization Bypass Through User-Controlled Key in the transaction API in Roskus Prospero Flow CRM 5.0.0 through 5.3.5 allows an authenticated user to read the
Authorization Bypass Through User-Controlled Key in the transaction API in Roskus Prospero
Flow CRM 5.0.0 through 5.3.5 allows an authenticated user to read the transactions of other
companies on the same instance via an incremented identifier in GET /api/transaction/{id},
which is resolved without company scoping and without any permission check.
References
- https://github.com/Roskus/prospero-flow-crm/commit/980c35ac00e419591a8adc2d1dbcc120ea62e27
- https://github.com/Roskus/prospero-flow-crm/releases/tag/v5.5.3
- https://secur0.com/en/cna/cve-list/cve-2026-77759-idor-missing-authz-prospero-transaction-
This high severity vulnerability with a CVSS score of 8.7 was published on 2026-08-21 via NVD.
vulnfeed aggregates 11625 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.