Skip to content
CVE PROGRAM SOURCE RECORD8.7 High

CVE-2026-77759

IDOR and missing authorization in the Prospero Flow CRM transaction API allow cross-tenant reading of financial records

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Secur0

Description

Authorization Bypass Through User-Controlled Key in the transaction API in Roskus Prospero Flow CRM 5.0.0 through 5.3.5 allows an authenticated user to read the transactions of other companies on the same instance via an incremented identifier in GET /api/transaction/{id}, which is resolved without company scoping and without any permission check.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Roskus Prospero Flow CRM

Default version status: unaffected

  • 5.0.0 to < 5.3.6affected

References