Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Authorization Bypass Through User-Controlled Key in the transaction save endpoint in Roskus Prospero Flow CRM 4.9.1 through 5.14.0 allows a user with transaction and accounting creation permissions to disclose another company's bank account name, bank name and card last four digits via a bank_account_id or bank_card_id belonging to that company in POST /transaction/save, which is persisted and rendered without any company ownership check.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-77780 Authorization Bypass in Roskus Prospero Flow CRM 4.9.1-5.14.0 Discloses Company Financial Data https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-77780
Post summary
The text announces CVE-2026-77780 as an authorization bypass flaw in Roskus Prospero Flow CRM that could expose company financial data, offering version details but lacking PoC, patch, or exploitation evidence.