CVE-2026-77759

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-77759", "assignerOrgId": "4daa8cea-433a-44bd-9456-53b127fc289a", "state": "PUBLISHED", "assignerShortName": "Secur0", "dateReserved": "2026-08-21T10:08:00.647Z", "datePublished": "2026-08-21T11:29:43.550Z", "dateUpdated": "2026-08-21T11:53:17.782Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "4daa8cea-433a-44bd-9456-53b127fc289a", "shortName": "Secur0", "dateUpdated": "2026-08-21T11:29:43.550Z"}, "title": "IDOR and missing authorization in the Prospero Flow CRM transaction API allow cross-tenant reading of financial records", "datePublic": "2026-08-21T11:21:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-639", "description": "CWE-639: Authorization Bypass Through User-Controlled Key", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-1", "descriptions": [{"lang": "en", "value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"}]}], "affected": [{"vendor": "Roskus", "product": "Prospero Flow CRM", "repo": "https://github.com/Roskus/prospero-flow-crm", "modules": ["Transaction API"], "programFiles": ["app/Http/Controllers/Api/Transaction/TransactionReadController.php", "routes/api.php"], "versions": [{"status": "affected", "version": "5.0.0", "lessThan": "5.3.6", "versionType": "semver"}], "defaultStatus": "unaffected"}], "cpeApplicability": [{"operator": "OR", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:roskus:prospero_flow_crm:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.0.0", "versionEndExcluding": "5.3.6"}]}]}], "descriptions": [{"lang": "en", "value": "Authorization Bypass Through User-Controlled Key in the transaction API in Roskus Prospero\nFlow CRM 5.0.0 through 5.3.5 allows an authenticated user to read the transactions of other\ncompanies on the same instance via an incremented identifier in GET /api/transaction/{id},\nwhich is resolved without company scoping and without any permission check.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Authorization Bypass Through User-Controlled Key in the transaction API in Roskus Prospero\nFlow CRM 5.0.0 through 5.3.5 allows an authenticated user to read the transactions of other\ncompanies on the same instance via an incremented identifier in GET /api/transaction/{id},\nwhich is resolved without company scoping and without any permission check."}]}], "tags": ["x_open-source"], "references": [{"url": "https://github.com/Roskus/prospero-flow-crm/commit/980c35ac00e419591a8adc2d1dbcc120ea62e273", "tags": ["patch"]}, {"url": "https://github.com/Roskus/prospero-flow-crm/releases/tag/v5.5.3", "tags": ["release-notes"]}, {"url": "https://secur0.com/en/cna/cve-list/cve-2026-77759-idor-missing-authz-prospero-transaction-api", "tags": ["technical-description", "third-party-advisory"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "HIGH", "baseScore": 8.7, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"}}], "solutions": [{"lang": "en", "value": "Upgrade to 5.3.6 or later. The fix was not tagged; the first tagged release carrying it is\nv5.5.3.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Upgrade to 5.3.6 or later. The fix was not tagged; the first tagged release carrying it is\n<code>v5.5.3</code>."}]}], "credits": [{"lang": "en", "value": "Marcos Garc\u00eda (s3ntinl)", "type": "finder"}, {"lang": "en", "value": "Xo\u00e1n M. Otero Jorge", "type": "analyst"}, {"lang": "en", "value": "Cristian Fern\u00e1ndez Cornejo", "type": "analyst"}, {"lang": "en", "value": "Secur0 CNA", "type": "coordinator"}, {"lang": "en", "value": "Gustavo Novaro", "type": "remediation developer"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 1.0.4"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-21T11:52:40.208082Z", "id": "CVE-2026-77759", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-21T11:53:17.782Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-77759", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-21T11:52:40.208082Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-21T11:53:08.078Z"}}], "cna": {"tags": ["x_open-source"], "title": "IDOR and missing authorization in the Prospero Flow CRM transaction API allow cross-tenant reading of financial records", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Marcos Garc\u00eda (s3ntinl)"}, {"lang": "en", "type": "analyst", "value": "Xo\u00e1n M. Otero Jorge"}, {"lang": "en", "type": "analyst", "value": "Cristian Fern\u00e1ndez Cornejo"}, {"lang": "en", "type": "coordinator", "value": "Secur0 CNA"}, {"lang": "en", "type": "remediation developer", "value": "Gustavo Novaro"}], "impacts": [{"capecId": "CAPEC-1", "descriptions": [{"lang": "en", "value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/Roskus/prospero-flow-crm", "vendor": "Roskus", "modules": ["Transaction API"], "product": "Prospero Flow CRM", "versions": [{"status": "affected", "version": "5.0.0", "lessThan": "5.3.6", "versionType": "semver"}], "programFiles": ["app/Http/Controllers/Api/Transaction/TransactionReadController.php", "routes/api.php"], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Upgrade to 5.3.6 or later. The fix was not tagged; the first tagged release carrying it is\nv5.5.3.", "supportingMedia": [{"type": "text/html", "value": "Upgrade to 5.3.6 or later. The fix was not tagged; the first tagged release carrying it is\n<code>v5.5.3</code>.", "base64": false}]}], "datePublic": "2026-08-21T11:21:00.000Z", "references": [{"url": "https://github.com/Roskus/prospero-flow-crm/commit/980c35ac00e419591a8adc2d1dbcc120ea62e273", "tags": ["patch"]}, {"url": "https://github.com/Roskus/prospero-flow-crm/releases/tag/v5.5.3", "tags": ["release-notes"]}, {"url": "https://secur0.com/en/cna/cve-list/cve-2026-77759-idor-missing-authz-prospero-transaction-api", "tags": ["technical-description", "third-party-advisory"]}], "x_generator": {"engine": "Vulnogram 1.0.4"}, "descriptions": [{"lang": "en", "value": "Authorization Bypass Through User-Controlled Key in the transaction API in Roskus Prospero\nFlow CRM 5.0.0 through 5.3.5 allows an authenticated user to read the transactions of other\ncompanies on the same instance via an incremented identifier in GET /api/transaction/{id},\nwhich is resolved without company scoping and without any permission check.", "supportingMedia": [{"type": "text/html", "value": "Authorization Bypass Through User-Controlled Key in the transaction API in Roskus Prospero\nFlow CRM 5.0.0 through 5.3.5 allows an authenticated user to read the transactions of other\ncompanies on the same instance via an incremented identifier in GET /api/transaction/{id},\nwhich is resolved without company scoping and without any permission check.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-639", "description": "CWE-639: Authorization Bypass Through User-Controlled Key"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:roskus:prospero_flow_crm:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.3.6", "versionStartIncluding": "5.0.0"}], "operator": "OR"}], "operator": "OR"}], "providerMetadata": {"orgId": "4daa8cea-433a-44bd-9456-53b127fc289a", "shortName": "Secur0", "dateUpdated": "2026-08-21T11:29:43.550Z"}}}, "cveMetadata": {"cveId": "CVE-2026-77759", "state": "PUBLISHED", "dateUpdated": "2026-08-21T11:53:17.782Z", "dateReserved": "2026-08-21T10:08:00.647Z", "assignerOrgId": "4daa8cea-433a-44bd-9456-53b127fc289a", "datePublished": "2026-08-21T11:29:43.550Z", "assignerShortName": "Secur0"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "modules": ["Transaction API"], "product": "Prospero Flow CRM", "programFiles": ["app/Http/Controllers/Api/Transaction/TransactionReadController.php", "routes/api.php"], "repo": "https://github.com/Roskus/prospero-flow-crm", "vendor": "Roskus", "versions": [{"lessThan": "5.3.6", "status": "affected", "version": "5.0.0", "versionType": "semver"}]}], "source": "4daa8cea-433a-44bd-9456-53b127fc289a"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Authorization Bypass Through User-Controlled Key in the transaction API in Roskus Prospero\nFlow CRM 5.0.0 through 5.3.5 allows an authenticated user to read the transactions of other\ncompanies on the same instance via an incremented identifier in GET /api/transaction/{id},\nwhich is resolved without company scoping and without any permission check."}, {"lang": "es", "value": "Elusi\u00f3n de autorizaci\u00f3n mediante clave controlada por el usuario en la API de transacciones en Roskus Prospero Flow CRM 5.0.0 a 5.3.5 permite a un usuario autenticado leer las transacciones de otras empresas en la misma instancia mediante un identificador incrementado en GET /api/transaction/{id}, que se resuelve sin delimitaci\u00f3n por empresa y sin ninguna comprobaci\u00f3n de permisos."}], "id": "CVE-2026-77759", "lastModified": "2026-10-15T19:10:00.173", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "4daa8cea-433a-44bd-9456-53b127fc289a", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-77759", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-21T11:52:40.208082Z", "version": "2.0.3"}}]}, "published": "2026-08-21T12:16:36.533", "references": [{"source": "4daa8cea-433a-44bd-9456-53b127fc289a", "url": "https://github.com/Roskus/prospero-flow-crm/commit/980c35ac00e419591a8adc2d1dbcc120ea62e273"}, {"source": "4daa8cea-433a-44bd-9456-53b127fc289a", "url": "https://github.com/Roskus/prospero-flow-crm/releases/tag/v5.5.3"}, {"source": "4daa8cea-433a-44bd-9456-53b127fc289a", "url": "https://secur0.com/en/cna/cve-list/cve-2026-77759-idor-missing-authz-prospero-transaction-api"}], "sourceIdentifier": "4daa8cea-433a-44bd-9456-53b127fc289a", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-639"}], "source": "4daa8cea-433a-44bd-9456-53b127fc289a", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[5.0.0,5.3.6)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Prospero Flow CRM", "source": "cna", "vendor": "Roskus"}, "product": "prospero_flow_crm", "vendor": "roskus"}], "created": "2026-08-21T12:30:14.263822+00:00", "updated": "2026-08-21T12:45:04.166799+00:00", "vendors": ["roskus", "roskus$PRODUCT$prospero_flow_crm"]}