Skip to content
Secur0
Solutions
View all AI Agent Security New Protect your AI agents Vulnerability Disclosure Secure reporting channel Penetration Testing Expert manual audits Crowdsourced Pentest Thousands of hackers, one goal Bug Bounty Success-based payment Live Hacking Live real-time pentesting For company teams Train your technical team For educational centers Bring hacking to the classroom For hackers Learn and get certified Competitions / CTFs Put your skills to the test
Customer Stories
View all Penetration Testing Manual pentesting VDP Secure reporting channel Pentest In-depth audits Crowdsourced Pentest Thousands of hackers, one goal Bug Bounty Success-based payment
Resources
About Secur0 Get to know us Jobs Join the team Media Kit Brand resources Contact Talk to us Newsletter Industry news Blog Articles and guides Partners Join the partner network We are a CNA We are a CVE Numbering Authority
Are you a hacker?
Request a demo Log in
Español English
Back to list
CVE-2026-77759 ·
High · August 21, 2026

IDOR and missing authorization in the Prospero Flow CRM transaction API allow cross-tenant reading of financial records

S0
Secur0 CNA
CVE-2026-77759

Description

Authorization Bypass Through User-Controlled Key (CWE-639) and Missing Authorization (CWE-862) in TransactionReadController::read() (app/Http/Controllers/Api/Transaction/TransactionReadController.php), exposed at GET /api/transaction/{id}, in Prospero Flow CRM 5.0.0 through 5.3.5 inclusive, which allows any authenticated user to read the transactions of any other company hosted on the same instance by substituting the identifier in the route, because the controller resolved the record with Transaction::find($id) without scoping to company_id and the route in routes/api.php applied only the auth:api middleware, with no permission check attached, unlike TransactionListController::index(), which in the same module resolves the listing with Transaction::where('company_id', Auth::user()->company_id). Identifiers are auto-incrementing integers, so walking the range exposes the full set of records. This results in cross-company disclosure of the financial data that makes up each transaction: name, type, amount, status, and issue and creation dates.

Vulnerability type (CWE)

CWE-639: Authorization Bypass Through User-Controlled Key CWE-862: Missing Authorization

Affected versions

Prospero Flow CRM from 5.0.0 through 5.3.5 inclusive. The endpoint was introduced with the transaction API CRUD in commit e3c6897d, which set APP_VERSION to 5.0.0, so earlier versions do not expose the route. No tagged release carries the flaw: the preceding tag, v4.6.0, predates the introduction, and the following tag, v5.5.3, already contains the fix. The fixed version, 5.3.6, is not tagged. Default status: unaffected.

Score (CVSS 4.0)

High (8.7)

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Solution

Upgrade to version 5.3.6 or later. The fix was not tagged: the first tagged release carrying it is v5.5.3.

Patch

Commit 980c35ac

Credits

  • Marcos García (s3ntinl) - finder
  • Xoán M. Otero Jorge - analyst
  • Cristian Fernández Cornejo - analyst
  • Secur0 CNA - coordinator
  • Gustavo Novaro - remediation developer Discovery source: External Official record: CVE-2026-77759