Is CVE-2026-77780 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-77780 being exploited in the wild.

How severe is CVE-2026-77780?

Informational severity, published 21 August 2026.

Which products and versions are affected?

Roskus Prospero Flow CRM 4.9.1 through 5.14.0.

Is there a fix for CVE-2026-77780?

A patch was published on 2026-07-27. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-77780 attacked?

It is attacked over the network.

Am I affected by CVE-2026-77780?

Check whether you run Roskus Prospero Flow CRM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-77780: Roskus Prospero Flow CRM authorization bypass in transaction save

CVE-2026-77780 · Severity: info · Published 2026-08-21

Prospero Flow CRM is a customer relationship management (CRM) platform used to manage business transactions and accounting. A flaw in the transaction save endpoint allows users with legitimate transaction creation permissions to access sensitive financial data (bank account names, bank names, and card details) belonging to other companies by manipulating transaction parameters, risking unauthorized disclosure of confidential banking information.

Technologies: Roskus Prospero Flow CRM. Vendors: Roskus.

Quick answers

Is CVE-2026-77780 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-77780 being exploited in the wild.
How severe is CVE-2026-77780?: Informational severity, published 21 August 2026.
Which products and versions are affected?: Roskus Prospero Flow CRM 4.9.1 through 5.14.0.
Is there a fix for CVE-2026-77780?: A patch was published on 2026-07-27. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-77780 attacked?: It is attacked over the network.
Am I affected by CVE-2026-77780?: Check whether you run Roskus Prospero Flow CRM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an authorization bypass (CWE-639) in the POST /transaction/save endpoint. The application fails to validate that foreign key identifiers (bank_account_id and bank_card_id) belong to the user's own company before processing and persisting the transaction. A user with transaction and accounting creation permissions can supply a bank_account_id or bank_card_id from another company, causing the application to retrieve and render that company's sensitive banking details (account name, bank name, card last four digits) without proper ownership verification. The fix, released in version 5.14.1, adds company ownership validation for all foreign key references during transaction save operations. Network-accessible POST endpoint; requires authentication and transaction creation permissions.

Affected products

Roskus Prospero Flow CRM 4.9.1 through 5.14.0

Timeline

2026-08-21: disclosed
2026-07-27: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.