CVE-2026-77780: Prospero Flow CRM 4.9.1 to before 5.14.2

Affected technology

Prospero Flow CRM · 4.9.1 to before 5.14.2
Roskus

Description’s affected range: Through User-Controlled Key in the transaction save endpoint in Roskus Prospero Flow CRM 4.9.1 through 5.14.0

Component: Transaction (Accounting) save path, Accounting listing
File: app/Http/Controllers/Transaction/TransactionSaveController.php, app/Http/Requests/TransactionSaveRequest.php

Attack conditions (Source advisory, CVSS 4.0): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

A user with transaction and accounting creation permissions can disclose another company's bank account name, bank name and card last four digits via a bank_account_id or bank_card_id belonging to that company in POST /transaction/save, which is persisted and rendered without any company ownership check. Source advisory’s CVSS 4.0 assessment (base score 5.3/10) rates confidentiality impact as low; integrity and availability impact as none.