Authorization Bypass in Roskus Prospero Flow CRM
CVE-2026-77759

8.7HIGH

Key Information:

Vendor

Roskus

Status
Prospero Flow Crm
Vendor
CVE Published:
21 August 2026

What is CVE-2026-77759?

An authorization bypass flaw exists in the transaction API of Roskus Prospero Flow CRM versions 5.0.0 through 5.3.5. This vulnerability allows authenticated users to access transaction data belonging to other companies within the same instance by exploiting an improperly scoped endpoint. Instead of enforcing proper authorization checks, the API accepts incremented identifiers in its GET requests, thereby exposing sensitive transaction information across different users.

Affected Version(s)

Prospero Flow CRM 5.0.0 < 5.3.6

References

https://github.com/Roskus/prospero-flow-crm/commit/980c35...
patch
https://github.com/Roskus/prospero-flow-crm/releases/tag/...
release-notes
https://secur0.com/en/cna/cve-list/cve-2026-77759-idor-mi...
technical-descriptionthird-party-advisory

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Marcos GarcĂ­a (s3ntinl)
Xoán M. Otero Jorge
Cristian Fernández Cornejo
Secur0 CNA
Gustavo Novaro
.