PT-2026-79384
CVE-2026-77780
·
Published
2026-08-21
·
Updated
2026-08-21
Description by
CVSS 4.0
5.3
MediumMetricsAV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions
Roskus Prospero Flow CRM versions 4.9.1 through 5.14.0
Description
An authorization bypass exists in the transaction save endpoint. A user with transaction and accounting creation permissions can disclose sensitive banking information from another company, including the bank account name, bank name, and the last four digits of a card. This occurs when a
bank account id or bank card id belonging to another company is provided in the POST '/transaction/save' endpoint, as the system persists and renders the data without verifying company ownership.Recommendations
Update Roskus Prospero Flow CRM to a version later than 5.14.0.
As a temporary mitigation, restrict user permissions for transaction and accounting creation to trusted personnel only.
Exploitability
Exploit
Fix
Impacts
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾