CVE-2026-77759: falha de alta gravidade em Roskus Prospero Flow CRM
IDOR and missing authorization in the Prospero Flow CRM transaction API allow cross-tenant reading of financial records
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.7epss 0.5%
Authorization Bypass Through User-Controlled Key in the transaction API in Roskus Prospero
Flow CRM 5.0.0 through 5.3.5 allows an authenticated user to read the transactions of other
companies on the same instance via an incremented identifier in GET /api/transaction/{id},
which is resolved without company scoping and without any permission check.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Produtos afetados
Roskus · Prospero Flow CRMCVEs relacionadas — Roskus Prospero Flow CRM
No mesmo produto, das mais perigosas para as menos.
CVE-2026-59239HIGHStored XSS in Prospero Flow CRM email body allows administrator account takeoverEPSS 0.7%CVE-2026-59235HIGHMissing authorization in Prospero Flow CRM allows low-privileged users to read all bank accountsEPSS 0.7%CVE-2026-59237MEDIUMIDOR in Prospero Flow CRM Order API allows cross-tenant read and modification of ordersEPSS 0.6%CVE-2026-59236MEDIUMAuthorization bypass in Prospero Flow CRM Excel import allows cross-tenant record injectionEPSS 0.6%CVE-2026-59234MEDIUMAuthorization Bypass Through User-Controlled Key in Prospero Flow CRM calendar event deletionEPSS 0.6%CVE-2026-19734HIGHIDOR in Prospero Flow CRM allows cross-tenant product disclosure and hijackingEPSS 0.6%