# CVE-2026-77759: Roskus Prospero Flow CRM authorization bypass in transaction API

Source: https://junglewise.ai/threats/cve-2026-77759-roskus-prospero-flow-crm-authorization-bypass-in-transaction-api  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-21. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-77759 · Severity: info · Published 2026-08-21

Prospero Flow CRM is a customer relationship management system used by businesses to manage sales and transactions. An authenticated user can view financial transaction records belonging to other companies on the same system by manipulating transaction IDs in API requests, bypassing company isolation and permission checks. This allows unauthorized access to sensitive financial data across customer accounts.

Technologies: [Roskus Prospero Flow CRM](https://junglewise.ai/threats/technologies/prospero-flow-crm). Vendors: [Roskus](https://junglewise.ai/threats/vendors/roskus).

## Quick answers

**Is CVE-2026-77759 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-77759 being exploited in the wild.

**How severe is CVE-2026-77759?** Informational severity, published 21 August 2026.

**Which products and versions are affected?** Roskus Prospero Flow CRM 5.0.0 through 5.3.5.

**Is there a fix for CVE-2026-77759?** A patch was published on 2026-06-26: Released in v5.5.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-77759 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-77759?** Check whether you run Roskus Prospero Flow CRM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an insecure direct object reference (IDOR) / authorization bypass in the GET /api/transaction/{id} endpoint. The transaction API resolves transaction IDs without company-level scoping or permission validation, allowing an authenticated attacker to enumerate and access transaction records of other companies on the same instance. The attack requires valid authentication but no additional preconditions. An attacker can read sensitive financial data across tenant boundaries. The fix (released in v5.5.3 and implemented in commit 980c35a) adds TransactionReadRequest permission checks and company_id scoping to the TransactionReadController.

## Affected products

- Roskus Prospero Flow CRM 5.0.0 through 5.3.5

## Timeline

- 2026-08-21: disclosed
- 2026-06-26: patched: Released in v5.5.3

## References

- [https://github.com/Roskus/prospero-flow-crm/commit/980c35ac00e419591a8adc2d1dbcc120ea62e273](https://github.com/Roskus/prospero-flow-crm/commit/980c35ac00e419591a8adc2d1dbcc120ea62e273)
- [https://github.com/Roskus/prospero-flow-crm/releases/tag/v5.5.3](https://github.com/Roskus/prospero-flow-crm/releases/tag/v5.5.3)

## Related threats

- [Roskus Prospero Flow CRM authorization bypass in user API](https://junglewise.ai/threats/cve-2026-114519-missing-authorization-cwe-862-in-the-user-api-of-roskus-prospero)
- [Roskus Prospero Flow CRM cross-site request forgery in order confirmation](https://junglewise.ai/threats/cve-2026-82911-roskus-prospero-flow-crm-cross-site-request-forgery-in-order)
- [Roskus Prospero Flow CRM stored XSS in product photo upload](https://junglewise.ai/threats/cve-2026-81931-roskus-prospero-flow-crm-stored-xss-in-product-photo-upload)
- [Roskus Prospero Flow CRM authorization bypass in supplier API](https://junglewise.ai/threats/cve-2026-78365-roskus-prospero-flow-crm-authorization-bypass-in-supplier-api)
- [Roskus Prospero Flow CRM stored XSS in company logo upload](https://junglewise.ai/threats/cve-2026-78337-roskus-prospero-flow-crm-stored-xss-in-company-logo-upload)