Skip to content
Secur0
Solutions
View all AI Agent Security New Protect your AI agents Vulnerability Disclosure Secure reporting channel Penetration Testing Expert manual audits Crowdsourced Pentest Thousands of hackers, one goal Bug Bounty Success-based payment Live Hacking Live real-time pentesting For company teams Train your technical team For educational centers Bring hacking to the classroom For hackers Learn and get certified Competitions / CTFs Put your skills to the test
Customer Stories
View all Penetration Testing Manual pentesting VDP Secure reporting channel Pentest In-depth audits Crowdsourced Pentest Thousands of hackers, one goal Bug Bounty Success-based payment
Resources
About Secur0 Get to know us Jobs Join the team Media Kit Brand resources Contact Talk to us Newsletter Industry news Blog Articles and guides Partners Join the partner network We are a CNA We are a CVE Numbering Authority
Are you a hacker?
Request a demo Log in
Español English
Back to list
CVE-2026-77780 ·
Medium · August 21, 2026

Unvalidated bank account and card foreign keys in the Prospero Flow CRM transaction save endpoint allow cross-tenant disclosure of banking identifiers

S0
Secur0 CNA
CVE-2026-77780

Description

Authorization Bypass Through User-Controlled Key (CWE-639) in TransactionSaveController::save() (app/Http/Controllers/Transaction/TransactionSaveController.php) and in TransactionSaveRequest::rules() (app/Http/Requests/TransactionSaveRequest.php), exposed at POST /transaction/save, in Prospero Flow CRM 4.9.1 through 5.14.0 inclusive, which allows a user whose role grants the transaction and accounting creation permissions to link their own transaction to a bank account or card belonging to another company hosted on the same instance, because bank_account_id and bank_card_id were validated only as ['nullable', 'integer'] and fill() persisted them with no check of ownership against company_id, unlike the transaction row itself, whose company_id is set from Auth::user(). The restriction to the caller's own records existed only in the form dropdowns (resources/views/transaction/transaction.blade.php), so submitting an unlisted identifier directly bypasses it. When the listing renders, TransactionIndexController eager-loads the bankAccount.bank and bankCard.bankAccount.bank relations, which are plain belongsTo relations with no company scoping, and resources/views/transaction/index.blade.php prints the account name, the bank name, and, where a card was linked, its last four digits. Identifiers are sequential integers, so walking the range repeats the operation against the remaining companies. This results in cross-company disclosure of other tenants' banking identifiers inside the attacker's own accounting list, with no interaction by the victim.

Vulnerability type (CWE)

CWE-639: Authorization Bypass Through User-Controlled Key

Affected versions

Prospero Flow CRM from 4.9.1 through 5.14.0 inclusive. The bank_account_id and bank_card_id foreign keys were added to the accounting save path in commit a9c4845f, which set APP_VERSION to 4.9.1, already carrying the ['nullable', 'integer'] rule; earlier versions do not accept those fields. Tag v4.6.0 predates the introduction and is unaffected, while tags v5.5.3 and v5.14.0 carry the flaw. The fix raises the version to 5.14.2, which is not tagged: v5.14.0 remains the most recent tag in the repository, so no tagged release yet carries the fix. Version 5.14.1 does not exist. Default status: unaffected.

Score (CVSS 4.0)

Medium (5.3)

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Solution

Upgrade to version 5.14.2 or later. The fix is not tagged, so installing the latest available tag (v5.14.0) leaves the system affected: take commit 5fd1fe86 or a version later than 5.14.2. The fix validates ownership at write time but does not review rows already stored, and does not scope the bankAccount() and bankCard() relations at read time, so existing transactions whose bank_account_id or bank_card_id points at another company should be reviewed.

Patch

Commit 5fd1fe86

Credits

  • Adrián García López - finder
  • Xoán M. Otero Jorge - analyst
  • Darío Rivas Quero - analyst
  • Secur0 CNA - coordinator
  • Gustavo Novaro - remediation developer Discovery source: External Official record: CVE-2026-77780