This vulnerability (CVE-2026-77780) in Roskus Prospero Flow CRM affects versions 4.9.1 up to but not including 5.14.2. It involves an authorization bypass through a user-controlled key in the POST /transaction/save endpoint. Users with permissions to create transactions and accounting entries can disclose another company's bank account details by supplying a bank_account_id or bank_card_id that belongs to that company. The system fails to perform ownership checks before saving and displaying this sensitive information, leading to unauthorized data disclosure. The CVSS 4.0 base score is 5.3 (medium severity), reflecting network attack vector, low complexity, no privileges required beyond transaction/accounting creation, no user interaction, and limited confidentiality impact.

An attacker with transaction and accounting creation permissions can access sensitive financial information of other companies, including bank account names, bank names, and card last four digits. This unauthorized disclosure could lead to privacy violations and potential misuse of financial data. However, the vulnerability does not allow modification or deletion of data, nor does it escalate privileges beyond the existing permissions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict transaction and accounting creation permissions to trusted users only. Monitor for unusual access patterns involving bank_account_id or bank_card_id parameters. Avoid exposing sensitive financial data in contexts where ownership verification is not enforced.