Description
Authorization Bypass Through User-Controlled Key in the transaction API in Roskus Prospero
Flow CRM 5.0.0 through 5.3.5 allows an authenticated user to read the transactions of other
companies on the same instance via an incremented identifier in GET /api/transaction/{id},
which is resolved without company scoping and without any permission check.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Roskus | Prospero Flow CRM | 5.0.0 – < 5.3.6 | 5.3.6 |
References
- https://github.com/Roskus/prospero-flow-crm/commit/980c35ac00e419591a8adc2d1dbcc120ea62e273 patch
- https://github.com/Roskus/prospero-flow-crm/releases/tag/v5.5.3 release-notes
- https://secur0.com/en/cna/cve-list/cve-2026-77759-idor-missing-authz-prospero-transaction-api technical-description third-party-advisory