Authorization Bypass Through User-Controlled Key in the transaction API in Roskus Prospero Flow CRM 5.0.0 through 5.3.5 allows an authenticated user… (CVE-2026-77759)

CVE-2026-77759 describes an authorization bypass vulnerability in Roskus Prospero Flow CRM versions 5.0.0 through 5.3.5. The flaw allows an authenticated user to read transactions of other companies hosted on the same CRM instance by manipulating the transaction ID parameter in the GET /api/transaction/{id} API call. The vulnerability arises from the absence of company scoping and permission verification in the transaction API, enabling unauthorized access to sensitive transaction data across company boundaries.

An attacker with valid authentication credentials can access transaction data belonging to other companies on the same CRM instance. This leads to unauthorized disclosure of potentially sensitive financial or business information. There is no indication of privilege escalation or remote unauthenticated exploitation. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the transaction API to trusted users only and monitor for suspicious activity related to transaction ID enumeration. Implement additional access controls or API gateway rules to enforce company scoping if possible.