CVE-2026-77780CWE-639

CVE-2026-77780

published August 21, 2026

CVSS
5.3
EPSS
0%
Percentile
37.1
In the wild
Unconfirmed
What it is

Authorization Bypass Through User-Controlled Key in the transaction save endpoint in Roskus

Prospero Flow CRM 4.9.1 through 5.14.0 allows a user with transaction and accounting

creation permissions to disclose another company's bank account name, bank name and card

last four digits via a bank_account_id or bank_card_id belonging to that company in POST

/transaction/save, which is persisted and rendered without any company ownership check.

The record
Technical detail
CVSS
5.3 · NONE
CVSS v4.0
5.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00439 · 37.1th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-08-21T17:18Z
References (3)
https://github.com/Roskus/prospero-flow-crm/commit/5fd1fe862bbdcbacf5d7e05c1c123981d8809674 · 4daa8cea-433a-44bd-9456-53b127fc289ahttps://github.com/Roskus/prospero-flow-crm/pull/261 · 4daa8cea-433a-44bd-9456-53b127fc289ahttps://secur0.com/en/cna/cve-list/cve-2026-77780-idor-unvalidated-bank-foreign-keys-prospero-transaction-save · 4daa8cea-433a-44bd-9456-53b127fc289a
EPSS history
Timeline
  • 21 AUG 12:12Z
    Unvalidated bank account and card foreign keys in the Prospero Flow CRM transaction save endpoint allow cross-tenant disclosure of banking identifiers
    cvelistv5