CVE-2026-77759

Name of the Vulnerable Software and Affected Versions Roskus Prospero Flow CRM versions 5.0.0 through 5.3.5

Description An authorization bypass exists in the transaction API that allows an authenticated user to read financial records belonging to other companies on the same instance. This occurs because the system fails to implement company scoping or permission checks when processing requests. The issue is triggered via an incremented identifier in the GET '/api/transaction/{id}' endpoint, specifically affecting the id variable.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.