High severity · published Aug 21, 2026
CVE-2026-77759
IDOR and missing authorization in the Prospero Flow CRM transaction API allow cross-tenant reading of financial records
8.7
CVSS
0.5%
EPSS
No
On KEV
Description
Authorization Bypass Through User-Controlled Key in the transaction API in Roskus Prospero
Flow CRM 5.0.0 through 5.3.5 allows an authenticated user to read the transactions of other
companies on the same instance via an incremented identifier in GET /api/transaction/{id},
which is resolved without company scoping and without any permission check.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 43% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PF
Prospero Flow CRM · Roskus
5.0.0 before 5.3.6 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-77759
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-77759
github.com
https://github.com/Roskus/prospero-flow-crm/commit/980c35ac00e419591a8adc2d1dbcc120ea62e273
github.com
https://github.com/Roskus/prospero-flow-crm/releases/tag/v5.5.3
secur0.com
https://secur0.com/en/cna/cve-list/cve-2026-77759-idor-missing-authz-prospero-transaction-api
More from Prospero Flow CRM
9.3
CVE-2026-78365
IDOR and missing authorization in Prospero Flow CRM supplier API allows cross-tenant read and modification
9.3
CVE-2026-19871
Use of hard-coded credentials in Prospero Flow CRM employee onboarding
8.7
CVE-2026-59233
Missing Authorization in Prospero Flow CRM permission save endpoint allows privilege escalation
8.7
CVE-2026-59235
Missing authorization in Prospero Flow CRM allows low-privileged users to read all bank accounts
8.6
CVE-2026-114519
Missing authorization in the Prospero Flow CRM user API allows a basic role user to read and delete other accounts