CVE-2026-77759: Prospero Flow CRM 5.0.0 to before 5.3.6

Affected technology

Prospero Flow CRM · 5.0.0 to before 5.3.6
Roskus

Description’s affected range: Through User-Controlled Key in the transaction API in Roskus Prospero Flow CRM 5.0.0 through 5.3.5

Component: Transaction API
File: app/Http/Controllers/Api/Transaction/TransactionReadController.php, routes/api.php

Attack conditions (Source advisory, CVSS 4.0): Network (remote) · No privileges required · No user interaction required

What an attacker can do

An authenticated user can read the transactions of other companies on the same instance via an incremented identifier in GET /api/transaction/{id}, which is resolved without company scoping and without any permission check. Source advisory’s CVSS 4.0 assessment (base score 8.7/10) rates confidentiality impact as high; integrity and availability impact as none.