Skip to content
CVE PROGRAM SOURCE RECORD5.3 Medium

CVE-2026-77780

Unvalidated bank account and card foreign keys in the Prospero Flow CRM transaction save endpoint allow cross-tenant disclosure of banking identifiers

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Secur0

Description

Authorization Bypass Through User-Controlled Key in the transaction save endpoint in Roskus Prospero Flow CRM 4.9.1 through 5.14.0 allows a user with transaction and accounting creation permissions to disclose another company's bank account name, bank name and card last four digits via a bank_account_id or bank_card_id belonging to that company in POST /transaction/save, which is persisted and rendered without any company ownership check.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Roskus Prospero Flow CRM

Default version status: unaffected

  • 4.9.1 to < 5.14.2affected

References