EUVD-2026-55618
GHSA-4fxp-2m36-qv64
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible endpoint requires only a valid session (PR:L); no complexity or interaction needed; scope unchanged as impact is contained within the application boundary; all three impacts high due to full permission takeover.
Primary rating from Vendor (Secur0).
CVSS VectorVendor: Secur0
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
Missing Authorization in the permission management component in Roskus Prospero Flow CRM before 5.2.1 allows any authenticated user to grant any role, including their own, the complete set of application permissions via a crafted POST request to the permission save endpoint, which performs no authorization check before synchronizing the submitted permissions to the specified role.
AnalysisAI
Privilege escalation in Roskus Prospero Flow CRM before version 5.2.1 permits any authenticated user - regardless of assigned role - to grant any application role the complete set of system permissions by sending a crafted POST request to the permission save endpoint. The vulnerable PermissionSaveController accepted a user-supplied roles array and invoked Spatie Permission's syncPermissions() with no prior authorization check, making low-trust authenticated accounts a direct path to full administrative control. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid authenticated session in Prospero Flow CRM - any role qualifies, as the endpoint imposes no role-based gate in the vulnerable version. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) accurately reflects the threat: network-accessible, low-complexity exploitation requiring only a valid authenticated session, with high impact on confidentiality, integrity, and availability of the vulnerable system. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with a low-privileged CRM account (e.g., a sales representative or contractor) sends a single crafted POST request to the `/permission` save endpoint with a JSON body mapping their own role's integer ID to an array of all available permission names. The vulnerable controller passes this directly to `syncPermissions()` without consulting any authorization gate, instantly persisting the full permission set to the targeted role. … |
| Remediation | Upgrade to Roskus Prospero Flow CRM version 5.2.1 or later immediately; the latest available release is v5.5.3 at https://github.com/Roskus/prospero-flow-crm/releases/tag/v5.5.3. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify and document all Roskus Prospero Flow CRM instances and their current versions; segregate any systems running version 5.2.0 or earlier if operationally feasible, and query admin audit logs for any unexpected administrative role assignments. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Prospero Flow Crm
View allCross-tenant authorization bypass (IDOR/BOLA) in Roskus Prospero Flow CRM 4.0.0 through 5.3.1 lets an authenticated user
Cross-tenant transaction data exposure in Roskus Prospero Flow CRM 5.0.0-5.3.5 allows any authenticated user on a shared
Broken function-level authorization in Prospero Flow CRM before 5.5.3 lets any authenticated low-privileged user (e.g. t
Cross-tenant IDOR in Roskus Prospero Flow CRM's ticket management component allows any authenticated user - regardless o
Cross-tenant payroll data exposure in Roskus Prospero Flow CRM before 5.15.10 enables authenticated users holding standa
Cross-tenant IDOR in Roskus Prospero Flow CRM before 5.4.7 allows any authenticated user to read sensitive product recor
Cross-tenant IDOR in Prospero Flow CRM before 5.4.8 allows any authenticated user to blindly overwrite contact records b
Unauthorized notification deletion in Prospero Flow CRM allows any authenticated user to delete other users' notificatio
Cross-tenant IDOR in Roskus Prospero Flow CRM before 5.5.3 allows any authenticated user to read, modify, and delete ord
Cross-tenant record injection in Roskus Prospero Flow CRM before 5.14.0 allows any authenticated user to silently insert
Tenant data boundary failure in Roskus Prospero Flow CRM 4.9.1-5.14.0 allows authenticated users holding transaction and
Stored cross-site scripting in Roskus Prospero Flow CRM before 5.16.0 allows an authenticated Seller-role user to achiev
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today