CVE-2026-77759
HighCVSS 8.7Summary
Roskus Prospero Flow CRM versions 5.0.0 through 5.3.5 have an authorization bypass through user-controlled key in the transaction API. An authenticated user can read transactions of other companies on the same instance via an incremented identifier in GET /api/transaction/{id}, without company scoping or permission check.
Risk Assessment
An authenticated user can access transactions of other companies, violating data confidentiality and potentially leading to leakage of sensitive information.
Recommendation
Update Prospero Flow CRM to a version later than 5.3.5 that includes the fix.
Other vulnerabilities in Prospero Flow CRM
See all- CVE-2026-77780Medium
Roskus Prospero Flow CRM versions 4.9.1 through 5.14.0 have an authorization bypass vulnerability via user-controlled key in the transaction save endpoint. A user with transaction creation permissions can disclose another company's bank account name, bank name, and card last four digits by providing a foreign `bank_account_id` or `bank_card_id` in POST /transaction/save.
- CVE-2026-59237Medium
The vulnerability allows an authenticated user to bypass authorization by manipulating numeric IDs in REST API endpoints. The Order and OrderItem controllers in Prospero Flow CRM before version 5.5.3 do not verify record ownership by the user's company, enabling reading, modifying, and deleting orders and order items belonging to other tenants.
- CVE-2026-59236Medium
A vulnerability in Prospero Flow CRM before version 5.14.0 allows an authenticated user to bypass authorization via a user-controlled key (CWE-639) in the Excel import functionality. An attacker can create customer, lead, and product records in another company's tenant by uploading a spreadsheet with a manipulated company_id column.
- CVE-2026-59235High
Missing authorization in BankAccountListController of Prospero Flow CRM below 5.5.3 allows an authenticated attacker with low privileges to read arbitrary bank account records via the API endpoint without proper role checks.
- CVE-2026-59234Medium
A vulnerability in Prospero Flow CRM before version 5.5.3 allows an authenticated attacker to delete arbitrary calendar events of other users by manipulating the {id} parameter in a GET request to /calendar/event/delete/{id}. The lack of ownership check (user_id/company_id) before deletion leads to unauthorized data destruction.
Original NVD description (English source)
Authorization Bypass Through User-Controlled Key in the transaction API in Roskus Prospero Flow CRM 5.0.0 through 5.3.5 allows an authenticated user to read the transactions of other companies on the same instance via an incremented identifier in GET /api/transaction/{id}, which is resolved without company scoping and without any permission check.