Vulnerability · Published Aug 21, 2026 · Assigned by Secur0

CVE-2026-77759IDOR and missing authorization in the Prospero Flow CRM transaction API allow cross-tenant reading of financial records

High 8.7

In plain English

A high-severity authorization bypass via user-controlled key in Prospero Flow CRM from Roskus. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities).

Severity (CVSS 4.0)8.7High

Exploit odds (30 days)0.5%top 56.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Authorization Bypass Through User-Controlled Key in the transaction API in Roskus Prospero Flow CRM 5.0.0 through 5.3.5 allows an authenticated user to read the transactions of other companies on the same instance via an incremented identifier in GET /api/transaction/{id}, which is resolved without company scoping and without any permission check.

Affected products (as reported)

Vendor	Product	Versions
Roskus	Prospero Flow CRM	5.0.0 – before 5.3.6

Weakness: CWE-639 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

References

https://github.com/Roskus/prospero-flow-crm/commit/980c35ac00e419591a8adc2d1dbcc120ea62e273 patch
https://github.com/Roskus/prospero-flow-crm/releases/tag/v5.5.3 release-notes
https://secur0.com/en/cna/cve-list/cve-2026-77759-idor-missing-authz-prospero-transaction-api technical-description, third-party-advisory