Executive brief
Prospero Flow CRM is a customer relationship management system used by businesses to manage sales and transactions. An authenticated user can view financial transaction records belonging to other companies on the same system by manipulating transaction IDs in API requests, bypassing company isolation and permission checks. This allows unauthorized access to sensitive financial data across customer accounts.
Technical details
The vulnerability is an insecure direct object reference (IDOR) / authorization bypass in the GET /api/transaction/{id} endpoint. The transaction API resolves transaction IDs without company-level scoping or permission validation, allowing an authenticated attacker to enumerate and access transaction records of other companies on the same instance. The attack requires valid authentication but no additional preconditions. An attacker can read sensitive financial data across tenant boundaries. The fix (released in v5.5.3 and implemented in commit 980c35a) adds TransactionReadRequest permission checks and company_id scoping to the TransactionReadController.
Affected products
- Roskus Prospero Flow CRM 5.0.0 through 5.3.5
Timeline
- 2026-08-21: disclosed
- 2026-06-26: patched: Released in v5.5.3