CVE-2026-77759CWE-639

CVE-2026-77759

published August 21, 2026

CVSS
8.7
EPSS
1%
Percentile
42.6
In the wild
Unconfirmed
What it is

Authorization Bypass Through User-Controlled Key in the transaction API in Roskus Prospero

Flow CRM 5.0.0 through 5.3.5 allows an authenticated user to read the transactions of other

companies on the same instance via an incremented identifier in GET /api/transaction/{id},

which is resolved without company scoping and without any permission check.

The record
Technical detail
CVSS
8.7 · NONE
CVSS v4.0
8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00509 · 42.6th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-08-21T16:16Z
References (3)
https://github.com/Roskus/prospero-flow-crm/commit/980c35ac00e419591a8adc2d1dbcc120ea62e273 · 4daa8cea-433a-44bd-9456-53b127fc289ahttps://github.com/Roskus/prospero-flow-crm/releases/tag/v5.5.3 · 4daa8cea-433a-44bd-9456-53b127fc289ahttps://secur0.com/en/cna/cve-list/cve-2026-77759-idor-missing-authz-prospero-transaction-api · 4daa8cea-433a-44bd-9456-53b127fc289a
EPSS history
Timeline
  • 21 AUG 11:29Z
    IDOR and missing authorization in the Prospero Flow CRM transaction API allow cross-tenant reading of financial records
    cvelistv5