CVEvulnerability

CVE-2026-77759

8.7 HIGH Published 2026-08-21 Modified 2026-10-15 Official page ↗

Status: Deferred
Published: 2026-08-21
Last modified: 2026-10-15
Assigner: 4daa8cea-433a-44bd-9456-53b127fc289a
CVSS 4.0 (4daa8cea-433a-44bd-9456-53b127fc289a): 8.7 HIGH — CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weaknesses: CWE-639

Description

Authorization Bypass Through User-Controlled Key in the transaction API in Roskus Prospero Flow CRM 5.0.0 through 5.3.5 allows an authenticated user to read the transactions of other companies on the same instance via an incremented identifier in GET /api/transaction/{id}, which is resolved without company scoping and without any permission check.

Weakness · CWE (1)

CWE-639 Authorization Bypass Through User-Controlled Key weakness

References

https://github.com/Roskus/prospero-flow-crm/commit/980c35ac00e419591a8adc2d1dbcc120ea62e273 github.com
https://github.com/Roskus/prospero-flow-crm/releases/tag/v5.5.3 github.com
https://secur0.com/en/cna/cve-list/cve-2026-77759-idor-missing-authz-prospero-transaction-api secur0.com

CVE-2026-77759

Description

Related

Weakness · CWE (1)

References