CVE-2026-77759 PUBLISHED

Authorization Bypass Through User-Controlled Key in the transaction API in Roskus Prospero Flow CRM 5.0.0 through 5.3.5 allows an authenticated user to read the transactions of other companies on the same instance via an incremented identifier in GET /api/transaction/{id}, which is resolved without company scoping and without any permission check.

Upgrade to 5.3.6 or later. The fix was not tagged; the first tagged release carrying it is v5.5.3.

• Marcos García (s3ntinl) finder
• Xoán M. Otero Jorge analyst
• Cristian Fernández Cornejo analyst
• Secur0 CNA coordinator
• Gustavo Novaro remediation developer

• https://github.com/Roskus/prospero-flow-crm/commit/980c35ac00e419591a8adc2d1dbcc120ea62e273
• https://github.com/Roskus/prospero-flow-crm/releases/tag/v5.5.3
• https://secur0.com/en/cna/cve-list/cve-2026-77759-idor-missing-authz-prospero-transaction-api

• CWE-639: Authorization Bypass Through User-Controlled Key CWE

• CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs