This vulnerability (CVE-2026-77759) affects Roskus Prospero Flow CRM versions 5.0.0 up to but not including 5.3.6. An authenticated user can bypass authorization controls in the transaction API endpoint GET /api/transaction/{id} by incrementing the transaction identifier. The API fails to enforce company scoping and permission verification, enabling the user to read transactions of other companies hosted on the same CRM instance. The issue is classified under CWE-639 (Authorization Bypass Through User-Controlled Key).

An attacker with valid authentication credentials can access sensitive transaction data of other companies sharing the same CRM instance without proper authorization. This leads to unauthorized data disclosure and potential privacy violations. There is no indication of privilege escalation or data modification, but confidentiality is compromised.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation has been documented at this time. Until a patch is available, restrict access to the affected API endpoint to trusted users only and monitor for suspicious access patterns.