CVE-2026-77780

Authorization Bypass Through User-Controlled Key in the transaction save endpoint in Roskus Prospero Flow CRM 4.9.1 through 5.14.0 allows a user with transaction and accounting creation permissions to disclose another company's bank account name, bank name and card last four digits via a bank_account_id or bank_card_id belonging to that company in POST /transaction/save, which is persisted and rendered without any company ownership check.

CVSS

No CVSS.

References

Link	Resource
https://github.com/Roskus/prospero-flow-crm/commit/5fd1fe862bbdcbacf5d7e05c1c123981d8809674
https://github.com/Roskus/prospero-flow-crm/pull/261
https://secur0.com/en/cna/cve-list/cve-2026-77780-idor-unvalidated-bank-foreign-keys-prospero-transaction-save

Configurations

No configuration.

History

15 Oct 2026, 19:10

Type	Values Removed	Values Added
Summary		(es) Elusión de autorización mediante clave controlada por el usuario en el punto final de guardado de transacciones en Roskus Prospero Flow CRM 4.9.1 hasta 5.14.0 permite a un usuario con permisos de creación de transacciones y contabilidad revelar el nombre de la cuenta bancaria, el nombre del banco y los últimos cuatro dígitos de la tarjeta de otra empresa a través de un bank_account_id o bank_card_id perteneciente a esa empresa en POST /transaction/save, que se persiste y se renderiza sin ninguna verificación de propiedad de la empresa.

Information

Published : 2026-08-21 13:18

Updated : 2026-10-15 19:10

NVD link : CVE-2026-77780

Mitre link : CVE-2026-77780

CVE.ORG link : CVE-2026-77780

JSON object : View

Products Affected

No product.

CWE

CWE-639

Authorization Bypass Through User-Controlled Key

{"id": "CVE-2026-77780", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-77780", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-21T15:56:49.202825Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "4daa8cea-433a-44bd-9456-53b127fc289a", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "4daa8cea-433a-44bd-9456-53b127fc289a", "affectedData": [{"repo": "https://github.com/Roskus/prospero-flow-crm", "vendor": "Roskus", "modules": ["Transaction (Accounting) save path", "Accounting listing"], "product": "Prospero Flow CRM", "versions": [{"status": "affected", "version": "4.9.1", "lessThan": "5.14.2", "versionType": "semver"}], "programFiles": ["app/Http/Controllers/Transaction/TransactionSaveController.php", "app/Http/Requests/TransactionSaveRequest.php"], "defaultStatus": "unaffected"}]}], "published": "2026-08-21T13:18:20.423", "references": [{"url": "https://github.com/Roskus/prospero-flow-crm/commit/5fd1fe862bbdcbacf5d7e05c1c123981d8809674", "source": "4daa8cea-433a-44bd-9456-53b127fc289a"}, {"url": "https://github.com/Roskus/prospero-flow-crm/pull/261", "source": "4daa8cea-433a-44bd-9456-53b127fc289a"}, {"url": "https://secur0.com/en/cna/cve-list/cve-2026-77780-idor-unvalidated-bank-foreign-keys-prospero-transaction-save", "source": "4daa8cea-433a-44bd-9456-53b127fc289a"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "4daa8cea-433a-44bd-9456-53b127fc289a", "description": [{"lang": "en", "value": "CWE-639"}]}], "descriptions": [{"lang": "en", "value": "Authorization Bypass Through User-Controlled Key in the transaction save endpoint in Roskus\nProspero Flow CRM 4.9.1 through 5.14.0 allows a user with transaction and accounting\ncreation permissions to disclose another company's bank account name, bank name and card\nlast four digits via a bank_account_id or bank_card_id belonging to that company in POST\n/transaction/save, which is persisted and rendered without any company ownership check."}, {"lang": "es", "value": "Elusi\u00f3n de autorizaci\u00f3n mediante clave controlada por el usuario en el punto final de guardado de transacciones en Roskus\nProspero Flow CRM 4.9.1 hasta 5.14.0 permite a un usuario con permisos de creaci\u00f3n de transacciones y contabilidad revelar el nombre de la cuenta bancaria, el nombre del banco y los \u00faltimos cuatro d\u00edgitos de la tarjeta de otra empresa a trav\u00e9s de un bank_account_id o bank_card_id perteneciente a esa empresa en POST /transaction/save, que se persiste y se renderiza sin ninguna verificaci\u00f3n de propiedad de la empresa."}], "lastModified": "2026-10-15T19:10:00.173", "sourceIdentifier": "4daa8cea-433a-44bd-9456-53b127fc289a"}