{"id":"CVE-2026-77780","title":"Authorization Bypass Through User-Controlled Key in the transaction save endpoint in Roskus\nProspero Flow CRM 4.9.1 through 5.14.0 allows a user with transaction and accounting\ncreation permissions to disclose another company's bank acco…","summary":"Authorization Bypass Through User-Controlled Key in the transaction save endpoint in Roskus\nProspero Flow CRM 4.9.1 through 5.14.0 allows a user with transaction and accounting\ncreation permissions to disclose another company's bank acco…","severity":"none","cwe":["CWE-639"],"published":"2026-08-21","updated":"2026-10-15","sourceUpdated":"2026-10-15T19:10:00.173","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-77780","references":[{"url":"https://github.com/Roskus/prospero-flow-crm/commit/5fd1fe862bbdcbacf5d7e05c1c123981d8809674","label":"4daa8cea-433a-44bd-9456-53b127fc289a"},{"url":"https://github.com/Roskus/prospero-flow-crm/pull/261","label":"4daa8cea-433a-44bd-9456-53b127fc289a"},{"url":"https://secur0.com/en/cna/cve-list/cve-2026-77780-idor-unvalidated-bank-foreign-keys-prospero-transaction-save","label":"4daa8cea-433a-44bd-9456-53b127fc289a"}],"tags":["nvd"],"epss":0.00439,"epssPercentile":0.3656,"ingestedAt":"2026-10-15T19:25:46.351Z","slug":"CVE-2026-77780","body":"## Overview\n\nAuthorization Bypass Through User-Controlled Key in the transaction save endpoint in Roskus\nProspero Flow CRM 4.9.1 through 5.14.0 allows a user with transaction and accounting\ncreation permissions to disclose another company's bank account name, bank name and card\nlast four digits via a bank_account_id or bank_card_id belonging to that company in POST\n/transaction/save, which is persisted and rendered without any company ownership check.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}