{
    "dataType": "CVE_RECORD",
    "dataVersion": "5.2",
    "cveMetadata": {
        "cveId": "CVE-2026-77759",
        "assignerOrgId": "4daa8cea-433a-44bd-9456-53b127fc289a",
        "state": "PUBLISHED",
        "assignerShortName": "Secur0",
        "dateReserved": "2026-08-21T10:08:00.647Z",
        "datePublished": "2026-08-21T11:29:43.550Z",
        "dateUpdated": "2026-08-21T11:53:17.782Z"
    },
    "containers": {
        "cna": {
            "providerMetadata": {
                "orgId": "4daa8cea-433a-44bd-9456-53b127fc289a",
                "shortName": "Secur0",
                "dateUpdated": "2026-08-21T11:29:43.550Z"
            },
            "title": "IDOR and missing authorization in the Prospero Flow CRM transaction API allow cross-tenant reading of financial records",
            "datePublic": "2026-08-21T11:21:00.000Z",
            "problemTypes": [
                {
                    "descriptions": [
                        {
                            "lang": "en",
                            "cweId": "CWE-639",
                            "description": "CWE-639: Authorization Bypass Through User-Controlled Key",
                            "type": "CWE"
                        }
                    ]
                }
            ],
            "impacts": [
                {
                    "capecId": "CAPEC-1",
                    "descriptions": [
                        {
                            "lang": "en",
                            "value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"
                        }
                    ]
                }
            ],
            "affected": [
                {
                    "vendor": "Roskus",
                    "product": "Prospero Flow CRM",
                    "repo": "https://github.com/Roskus/prospero-flow-crm",
                    "modules": [
                        "Transaction API"
                    ],
                    "programFiles": [
                        "app/Http/Controllers/Api/Transaction/TransactionReadController.php",
                        "routes/api.php"
                    ],
                    "versions": [
                        {
                            "status": "affected",
                            "version": "5.0.0",
                            "lessThan": "5.3.6",
                            "versionType": "semver"
                        }
                    ],
                    "defaultStatus": "unaffected"
                }
            ],
            "cpeApplicability": [
                {
                    "operator": "OR",
                    "nodes": [
                        {
                            "operator": "OR",
                            "negate": false,
                            "cpeMatch": [
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:a:roskus:prospero_flow_crm:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "5.0.0",
                                    "versionEndExcluding": "5.3.6"
                                }
                            ]
                        }
                    ]
                }
            ],
            "descriptions": [
                {
                    "lang": "en",
                    "value": "Authorization Bypass Through User-Controlled Key in the transaction API in Roskus Prospero\nFlow CRM 5.0.0 through 5.3.5 allows an authenticated user to read the transactions of other\ncompanies on the same instance via an incremented identifier in GET /api/transaction/{id},\nwhich is resolved without company scoping and without any permission check.",
                    "supportingMedia": [
                        {
                            "type": "text/html",
                            "base64": false,
                            "value": "Authorization Bypass Through User-Controlled Key in the transaction API in Roskus Prospero\nFlow CRM 5.0.0 through 5.3.5 allows an authenticated user to read the transactions of other\ncompanies on the same instance via an incremented identifier in GET /api/transaction/{id},\nwhich is resolved without company scoping and without any permission check."
                        }
                    ]
                }
            ],
            "tags": [
                "x_open-source"
            ],
            "references": [
                {
                    "url": "https://github.com/Roskus/prospero-flow-crm/commit/980c35ac00e419591a8adc2d1dbcc120ea62e273",
                    "tags": [
                        "patch"
                    ]
                },
                {
                    "url": "https://github.com/Roskus/prospero-flow-crm/releases/tag/v5.5.3",
                    "tags": [
                        "release-notes"
                    ]
                },
                {
                    "url": "https://secur0.com/en/cna/cve-list/cve-2026-77759-idor-missing-authz-prospero-transaction-api",
                    "tags": [
                        "technical-description",
                        "third-party-advisory"
                    ]
                }
            ],
            "metrics": [
                {
                    "format": "CVSS",
                    "scenarios": [
                        {
                            "lang": "en",
                            "value": "GENERAL"
                        }
                    ],
                    "cvssV4_0": {
                        "attackVector": "NETWORK",
                        "attackComplexity": "LOW",
                        "attackRequirements": "NONE",
                        "privilegesRequired": "NONE",
                        "userInteraction": "NONE",
                        "vulnConfidentialityImpact": "HIGH",
                        "subConfidentialityImpact": "NONE",
                        "vulnIntegrityImpact": "NONE",
                        "subIntegrityImpact": "NONE",
                        "vulnAvailabilityImpact": "NONE",
                        "subAvailabilityImpact": "NONE",
                        "exploitMaturity": "NOT_DEFINED",
                        "Safety": "NOT_DEFINED",
                        "Automatable": "NOT_DEFINED",
                        "Recovery": "NOT_DEFINED",
                        "valueDensity": "NOT_DEFINED",
                        "vulnerabilityResponseEffort": "NOT_DEFINED",
                        "providerUrgency": "NOT_DEFINED",
                        "version": "4.0",
                        "baseSeverity": "HIGH",
                        "baseScore": 8.7,
                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"
                    }
                }
            ],
            "solutions": [
                {
                    "lang": "en",
                    "value": "Upgrade to 5.3.6 or later. The fix was not tagged; the first tagged release carrying it is\nv5.5.3.",
                    "supportingMedia": [
                        {
                            "type": "text/html",
                            "base64": false,
                            "value": "Upgrade to 5.3.6 or later. The fix was not tagged; the first tagged release carrying it is\n<code>v5.5.3</code>."
                        }
                    ]
                }
            ],
            "credits": [
                {
                    "lang": "en",
                    "value": "Marcos García (s3ntinl)",
                    "type": "finder"
                },
                {
                    "lang": "en",
                    "value": "Xoán M. Otero Jorge",
                    "type": "analyst"
                },
                {
                    "lang": "en",
                    "value": "Cristian Fernández Cornejo",
                    "type": "analyst"
                },
                {
                    "lang": "en",
                    "value": "Secur0 CNA",
                    "type": "coordinator"
                },
                {
                    "lang": "en",
                    "value": "Gustavo Novaro",
                    "type": "remediation developer"
                }
            ],
            "source": {
                "discovery": "EXTERNAL"
            },
            "x_generator": {
                "engine": "Vulnogram 1.0.4"
            }
        },
        "adp": [
            {
                "metrics": [
                    {
                        "other": {
                            "type": "ssvc",
                            "content": {
                                "timestamp": "2026-08-21T11:52:40.208082Z",
                                "id": "CVE-2026-77759",
                                "options": [
                                    {
                                        "Exploitation": "none"
                                    },
                                    {
                                        "Automatable": "yes"
                                    },
                                    {
                                        "Technical Impact": "partial"
                                    }
                                ],
                                "role": "CISA Coordinator",
                                "version": "2.0.3"
                            }
                        }
                    }
                ],
                "title": "CISA ADP Vulnrichment",
                "providerMetadata": {
                    "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
                    "shortName": "CISA-ADP",
                    "dateUpdated": "2026-08-21T11:53:17.782Z"
                }
            }
        ]
    }
}