IDOR and missing authorization in the Prospero Flow CRM transaction API allow cross-tenant reading of financial records
Summary
| CVE | CVE-2026-77759 |
|---|---|
| State | PUBLISHED |
| Assigner | Secur0 |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-08-21 12:16:36 UTC |
| Updated | 2026-08-21 12:16:36 UTC |
| Description | Authorization Bypass Through User-Controlled Key in the transaction API in Roskus Prospero Flow CRM 5.0.0 through 5.3.5 allows an authenticated user to read the transactions of other companies on the same instance via an incremented identifier in GET /api/transaction/{id}, which is resolved without company scoping and without any permission check. |
Risk And Classification
Primary CVSS: v4.0 8.7 HIGH from 4daa8cea-433a-44bd-9456-53b127fc289a
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Problem Types: CWE-639 | CWE-639 CWE-639: Authorization Bypass Through User-Controlled Key
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 4.0 | 4daa8cea-433a-44bd-9456-53b127fc289a | Secondary | 8.7 | HIGH | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/C... |
| 4.0 | CNA | CVSS | 8.7 | HIGH | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N |
CVSS v4.0 Breakdown
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Roskus | Prospero Flow CRM | affected 5.0.0 5.3.6 semver | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| github.com/Roskus/prospero-flow-crm/releases/tag/v5.5.3 | 4daa8cea-433a-44bd-9456-53b127fc289a | github.com | |
| secur0.com/en/cna/cve-list/cve-2026-77759-idor-missing-authz-prospero-tr... | 4daa8cea-433a-44bd-9456-53b127fc289a | secur0.com | |
| github.com/Roskus/prospero-flow-crm/commit/980c35ac00e419591a8adc2d1dbcc... | 4daa8cea-433a-44bd-9456-53b127fc289a | github.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: Marcos García (s3ntinl) (en)
CNA: Xoán M. Otero Jorge (en)
CNA: Cristian Fernández Cornejo (en)
CNA: Secur0 CNA (en)
CNA: Gustavo Novaro (en)
Additional Advisory Data
Solutions
CNA: Upgrade to 5.3.6 or later. The fix was not tagged; the first tagged release carrying it is v5.5.3.