CVE-2026-77780: CWE-639: Authorization Bypass Through User-Controlled Key in Roskus Prospero Flow CRM

This vulnerability (CVE-2026-77780) in Roskus Prospero Flow CRM affects versions 4.9.1 up to but not including 5.14.2. It involves an authorization bypass through a user-controlled key in the POST /transaction/save endpoint. Users with permissions to create transactions and accounting entries can disclose another company's sensitive bank details by referencing bank_account_id or bank_card_id values belonging to that company. The flaw stems from the lack of ownership checks when saving and displaying these details, violating proper authorization controls (CWE-639). The CVSS 4.0 base score is 5.3, indicating a medium severity vulnerability with network attack vector, low attack complexity, and no privileges required beyond transaction/account creation rights.

An attacker with transaction and accounting creation permissions can access sensitive financial information of other companies, including bank account names, bank names, and card last four digits. This unauthorized disclosure could lead to privacy violations and potential financial information leakage. However, the attacker must already have some level of permissions within the system, and there is no indication of remote code execution or system compromise.

No official patch or fix is currently documented in the provided data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict transaction and accounting creation permissions to trusted users only and monitor for suspicious activity related to transaction save operations. Implement additional access control checks at the application level if possible to verify company ownership before processing bank account or card identifiers.