{"id":"CVE-2026-59233","state":"PUBLISHED","title":"Missing Authorization in Prospero Flow CRM permission save endpoint allows privilege escalation","description":"Missing Authorization in the permission management component in Roskus Prospero Flow CRM before 5.2.1 allows any authenticated user to grant any role, including their own, the complete set of application permissions via a crafted POST request to the permission save endpoint, which performs no authorization check before synchronizing the submitted permissions to the specified role.","publishedAt":"2026-08-10T12:14:40.002Z","updatedAt":"2026-08-10T17:52:43.950Z","severity":{"score":8.7,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","source":"Secur0"},"assigner":"Secur0","products":["Roskus Prospero Flow CRM"],"affected":[{"vendor":"Roskus","product":"Prospero Flow CRM","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"5.2.1","versionType":"semver"}],"repo":"https://github.com/Roskus/prospero-flow-crm","modules":["Permission management"],"programFiles":["app/Http/Controllers/Permission/PermissionSaveController.php","routes/web.php"]}],"references":["https://github.com/Roskus/prospero-flow-crm/commit/86a7d6557bd111518a221f4575ad6e36087e19d3","https://github.com/Roskus/prospero-flow-crm/releases/tag/v5.5.3","https://secur0.com/en/cna/cve-list/cve-2026-59233-missing-authorization-in-prospero-flow-crm-permission-endpoint"],"weaknesses":["CWE-639"],"ingestedAt":"2026-10-29T20:12:32.778Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/59xxx/CVE-2026-59233.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-59233","state":"PUBLISHED","datePublished":"2026-08-10T12:14:40.002Z","dateUpdated":"2026-08-10T17:52:43.950Z","assignerShortName":"Secur0","assignerOrgId":"4daa8cea-433a-44bd-9456-53b127fc289a","dateReserved":"2026-07-03T11:24:39.241Z"},"containers":{"cna":{"title":"Missing Authorization in Prospero Flow CRM permission save endpoint allows privilege escalation","descriptions":[{"lang":"en","value":"Missing Authorization in the permission management component in Roskus Prospero Flow CRM before 5.2.1 allows any authenticated user to grant any role, including their own, the complete set of application permissions via a crafted POST request to the permission save endpoint, which performs no authorization check before synchronizing the submitted permissions to the specified role."}],"affected":[{"vendor":"Roskus","product":"Prospero Flow CRM","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"5.2.1","versionType":"semver"}],"repo":"https://github.com/Roskus/prospero-flow-crm","modules":["Permission management"],"programFiles":["app/Http/Controllers/Permission/PermissionSaveController.php","routes/web.php"]}],"references":[{"url":"https://github.com/Roskus/prospero-flow-crm/commit/86a7d6557bd111518a221f4575ad6e36087e19d3","tags":["patch"]},{"url":"https://github.com/Roskus/prospero-flow-crm/releases/tag/v5.5.3","tags":["release-notes"]},{"url":"https://secur0.com/en/cna/cve-list/cve-2026-59233-missing-authorization-in-prospero-flow-crm-permission-endpoint","tags":["technical-description"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV4_0":{"attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","subIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","version":"4.0","baseSeverity":"HIGH","baseScore":8.7,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-639","lang":"en","description":"CWE-639 Authorization bypass through User-Controlled key","type":"CWE"}]}],"providerMetadata":{"shortName":"Secur0","orgId":"4daa8cea-433a-44bd-9456-53b127fc289a","dateUpdated":"2026-08-10T12:14:40.002Z"},"datePublic":"2026-08-10T12:09:00.000Z","impacts":[{"capecId":"CAPEC-1","descriptions":[{"lang":"en","value":"CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"}]}],"cpeApplicability":[{"operator":"OR","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:roskus:prospero_flow_crm:*:*:*:*:*:*:*:*","versionStartIncluding":"0","versionEndExcluding":"5.2.1"}]}]}],"tags":["x_open-source"],"solutions":[{"lang":"en","value":"Upgrade to version 5.2.1 or higher.","supportingMedia":[{"type":"text/html","base64":false,"value":"Upgrade to version 5.2.1 or higher."}]}],"credits":[{"lang":"en","value":"k1di3","type":"finder"},{"lang":"en","value":"Cristian Fernández Cornejo","type":"analyst"},{"lang":"en","value":"Xoán M. Otero Jorge","type":"analyst"},{"lang":"en","value":"Secur0 CNA","type":"coordinator"},{"lang":"en","value":"Gustavo Novaro","type":"remediation developer"}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 1.0.4"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-08-10T17:52:31.556651Z","id":"CVE-2026-59233","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-08-10T17:52:43.950Z"}}]}}}