CVE-2026-59233
Received Received - Intake

Missing Authorization in Roskus Prospero Flow CRM

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: 4daa8cea-433a-44bd-9456-53b127fc289a

Description
Missing Authorization in the permission management component in Roskus Prospero Flow CRM before 5.2.1 allows any authenticated user to grant any role, including their own, the complete set of application permissions via a crafted POST request to the permission save endpoint, which performs no authorization check before synchronizing the submitted permissions to the specified role.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-10
Last Modified
2026-08-10
Generated
2026-08-10
AI Q&A
2026-08-10
EPSS Evaluated
N/A
NVD
CVE-2026-59233
EUVD
EUVD-2026-55618

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
roskus prospero_flow_crm 5.2.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Missing Authorization in Roskus Prospero Flow CRM before 5.2.1 allows any authenticated user to grant any role, including their own, full application permissions via a crafted POST request to the permission save endpoint. The system fails to check authorization before updating role permissions.

Impact Analysis

An attacker with valid credentials could escalate their own or another user's privileges to gain full control over the CRM system. This could lead to unauthorized data access, modification, or deletion of sensitive information stored in the application.

Compliance Impact

This vulnerability could lead to unauthorized access or modification of personal or health data, violating GDPR and HIPAA requirements for data integrity and access control. Organizations using affected versions may face compliance violations and potential fines.

Mitigation Strategies

Immediately upgrade Roskus Prospero Flow CRM to version 5.2.1 or later to address the missing authorization flaw in the permission management component.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-59233. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart