Root cause
Authentication & access control introduced
The assistant-written controller for a single transaction looked the record up by path id with no company filter and no permission request.
AI-assisted change: Claude
A CLI coding assistant co-authored the commit that added the transaction API, and its single-transaction endpoint fetched any record by primary key without company scoping or a permission check.
How AI contributed: Direct introductionPublished Aug 21, 2026 in 
roskus/prospero-flow-crmAll 3 findings in this repository
Show full advisory descriptionHide advisory description
The change added a full set of transaction endpoints written with a coding assistant. The listing endpoint scoped every query to the caller's company, but the single-transaction endpoint kept a raw primary-key lookup, so the company scope and the permission check that the sibling endpoints received were missing from exactly one handler. The route was protected only by token authentication, which proves who is calling, not which records that caller may see. An attacker holding any valid account could walk the id space and read other companies' financial records. The follow-up change adds a permission-checking request class and rewrites the lookup to filter on the caller's company id before the record is returned.
What actually happenedHide details
The route for a single transaction sat behind token authentication only, and the handler resolved the path id straight into a database lookup. Any signed-in caller from another company could therefore read a transaction by editing the id, because the query carried no company filter and the endpoint skipped the permission request class that the other transaction endpoints used.
Fix
Security fix
A permission-checking request class and a company-scoped query now gate the endpoint, so a caller can only read records that belong to their own company.
Fix by Gustavo Novaro · no AI marker found
Case facts
- CVE ID
- CVE-2026-77759
- GHSA ID
- GHSA-CW49-MHMJ-M3XC
- Published
- Aug 21, 2026
- Severity
- Not scored
- Language
- PHP
- AI tool
Claude- AI role
- Direct introduction
- Vulnerable release
- 5.0.0 through 5.3.5
- Fixed release
- v5.5.3
AI-assisted change
AI-assisted changeapp/Http/Controllers/Api/Transaction/TransactionReadController.phpsource roskus/prospero-flow-crm@e3c6897d0c+42−0
@@ -0,0 +1,42 @@+<?php++declare(strict_types=1);+Show 38 hidden lines
+namespace App\Http\Controllers\Api\Transaction;++use App\Models\Transaction;+use Illuminate\Http\JsonResponse;+use OpenApi\Attributes as OAT;++class TransactionReadController+{+ #[OAT\Get(+ path: '/transaction/{id}',+ summary: 'Get Transaction details',+ security: [['bearerAuth' => []]],+ tags: ['Transaction'],+ parameters: [+ new OAT\Parameter(+ name: 'id',+ in: 'path',+ required: true,+ description: 'Transaction ID',+ schema: new OAT\Schema(type: 'integer')+ ),+ ],+ responses: [+ new OAT\Response(response: 200, description: 'Transaction found'),+ new OAT\Response(response: 404, description: 'Transaction not found'),+ ]+ )]+ public function read(int $id): JsonResponse+ {+ $transaction = Transaction::find($id);++ if (! $transaction) {+ return response()->json(['message' => 'Transaction not found'], 404);+ }++ return response()->json(['transaction' => $transaction], 200);+ }+}the handler passes the path id straight to a model lookup and returns whatever it finds, with no company filter and no authorization request.
Security fix
Fixapp/Http/Controllers/Api/Transaction/TransactionReadController.phpsource roskus/prospero-flow-crm@980c35ac00+4−2
@@ -4,8 +4,10 @@ namespace App\Http\Controllers\Api\Transaction; +use App\Http\Requests\TransactionReadRequest; use App\Models\Transaction; use Illuminate\Http\JsonResponse;+use Illuminate\Support\Facades\Auth;Show 15 hidden lines
use OpenApi\Attributes as OAT; class TransactionReadController@@ -29,9 +31,9 @@ class TransactionReadController new OAT\Response(response: 404, description: 'Transaction not found'), ] )]- public function read(int $id): JsonResponse+ public function read(TransactionReadRequest $request, int $id): JsonResponse {- $transaction = Transaction::find($id);+ $transaction = Transaction::where('company_id', Auth::user()->company_id)->find($id); if (! $transaction) { return response()->json(['message' => 'Transaction not found'], 404);a request class that enforces the read permission and a lookup filtered by the caller's company id before a transaction is returned.
Patch fingerprints
AI-assisted change 6684c8f38a7d15e121247e1b15eaa6b8f6cf99dab4a7095ea77dd261fcb3c7d3 · Fix b05d23a4f8cd9a87262cfb2021f1f321f4e69719be7274cf591bc15bd2efa438