Authorization Bypass Vulnerability in Roskus Prospero Flow CRM

CVE-2026-77780

What is CVE-2026-77780?

An authorization bypass vulnerability exists in Roskus Prospero Flow CRM that allows users with transaction and accounting creation permissions to access sensitive information from other companies. Specifically, it permits the disclosure of a company's bank account name, bank name, and the last four digits of the bank card. This occurs through inadequate ownership checks in the POST request to the /transaction/save endpoint, enabling user-controlled keys to bypass necessary authorization protocols.

References