CyberRota Analysis
AI-GeneratedThe transaction API in Roskus Prospero Flow CRM versions 5.0.0 to 5.3.5 is vulnerable to an authorization bypass, allowing authenticated users to access transaction data from other companies by manipulating the identifier in the API request. This flaw can lead to unauthorized data exposure, posing significant risks to data privacy and integrity. Organizations using affected versions should prioritize patching this vulnerability to safeguard sensitive transaction information.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Authorization Bypass Through User-Controlled Key in the transaction API in Roskus Prospero Flow CRM 5.0.0 through 5.3.5 allows an authenticated user to read the transactions of other companies on the same instance via an incremented identifier in GET /api/transaction/{id}, which is resolved without company scoping and without any permission check.