CVE-2026-77759: IDOR and missing authorization in the Prospero Flow CRM transaction API allow cross-tenant reading of financial records
Authorization Bypass Through User-Controlled Key in the transaction API in Roskus Prospero Flow CRM 5.0.0 through 5.3.5 allows an authenticated user to read the transactions of other companies on the same instance via an incremented identifier in GET /api/transaction/{id}, which is resolved without company scoping and without any permission check.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Roskus Prospero Flow CRMto a version that resolves this vulnerability.Fixed in 5.3.6
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated user on a shared Prospero Flow CRM instance can exploit it. The issue permits cross-company access, so exposure is relevant where multiple companies use the same instance.
What does an attacker need to do?
The attacker needs a valid authenticated session and a transaction identifier. They can request GET /api/transaction/{id} with incremented identifiers to retrieve other companies' transaction records.
Are affected versions identified?
Roskus Prospero Flow CRM versions 5.0.0 through 5.3.5 are identified as affected. The referenced release is v5.5.3.