CVE-2026-77759: CWE-639: Authorization Bypass Through User-Controlled Key in Roskus Prospero Flow CRM

This vulnerability (CVE-2026-77759) affects Roskus Prospero Flow CRM versions 5.0.0 through 5.3.5. The transaction API endpoint GET /api/transaction/{id} permits an authenticated user to read transactions of other companies hosted on the same instance by incrementing the transaction ID parameter. The root cause is the lack of company scoping and absence of permission checks in the API, leading to an authorization bypass. This is classified under CWE-639 (Authorization Bypass Through User-Controlled Key). The CVSS 4.0 base score is 8.7 (high severity), indicating a network attack vector with low complexity and no privileges or user interaction required, but with high impact on confidentiality.

An attacker with valid authentication credentials can access sensitive transaction data belonging to other companies sharing the same CRM instance. This compromises confidentiality of business data across tenant boundaries. There is no indication of privilege escalation or integrity/availability impact. No known exploits are reported in the wild at this time.

No official patch or fix links are provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the API to trusted users only and monitor for suspicious access patterns. Avoid exposing the vulnerable API endpoint to untrusted networks.