EUVD-2026-71268
GHSA-4758-h5xr-5h97
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
User interaction is required (victim must click link); no confidentiality or availability impact; integrity impact is low (order state change only).
Primary rating from Vendor (Secur0).
CVSS VectorVendor: Secur0
Lifecycle Timeline
2DescriptionCVE.org
Cross-Site Request Forgery (CSRF) in the OrderConfirmController at GET /order/confirm/{order_number} in Roskus Prospero Flow CRM before 5.15.11 allows an unauthenticated attacker to confirm any order on behalf of an authenticated user by directing them to a crafted page. Laravel's VerifyCsrfToken middleware enforces CSRF tokens only on POST, PUT, PATCH, and DELETE requests; the Route::get declaration leaves this state-changing action unprotected. Session cookies configured with SameSite=Lax are automatically included in top-level cross-site navigation, so a single link click triggers OrderConfirmController::confirm() and transitions the target order from pending to confirmed without user authorization. Because order numbers are sequential integers, an attacker can enumerate and confirm all existing orders in a single automated sweep.
AnalysisAI
Order confirmation in Roskus Prospero Flow CRM before 5.15.11 can be triggered by an unauthenticated attacker on behalf of any authenticated user through a classic CSRF exploit. The root cause is a state-changing action exposed via HTTP GET at /order/confirm/{order_number}, which Laravel's VerifyCsrfToken middleware does not protect - middleware enforcement is limited to POST, PUT, PATCH, and DELETE. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The victim must be authenticated to the Prospero Flow CRM application at the time of exploitation (an active, valid session cookie must be present). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N, score 5.1) is well-calibrated to the actual impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Roskus Prospero Flow CRM version 5.15.11, which resolves the vulnerability by converting the confirm route from GET to POST (Route::post) and adding a @csrf Blade token in the confirmation form, as documented in commit a90c0c8c (https://github.com/Roskus/prospero-flow-crm/commit/a90c0c8c). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Prospero Flow Crm
View allCross-tenant authorization bypass (IDOR/BOLA) in Roskus Prospero Flow CRM 4.0.0 through 5.3.1 lets an authenticated user
Cross-tenant transaction data exposure in Roskus Prospero Flow CRM 5.0.0-5.3.5 allows any authenticated user on a shared
Privilege escalation in Roskus Prospero Flow CRM before version 5.2.1 permits any authenticated user - regardless of ass
Broken function-level authorization in Prospero Flow CRM before 5.5.3 lets any authenticated low-privileged user (e.g. t
Cross-tenant IDOR in Roskus Prospero Flow CRM before 5.4.7 allows any authenticated user to read sensitive product recor
Cross-tenant IDOR in Roskus Prospero Flow CRM's ticket management component allows any authenticated user - regardless o
Cross-tenant payroll data exposure in Roskus Prospero Flow CRM before 5.15.10 enables authenticated users holding standa
Cross-tenant IDOR in Prospero Flow CRM before 5.4.8 allows any authenticated user to blindly overwrite contact records b
Unauthorized notification deletion in Prospero Flow CRM allows any authenticated user to delete other users' notificatio
Cross-tenant IDOR in Roskus Prospero Flow CRM before 5.5.3 allows any authenticated user to read, modify, and delete ord
Cross-tenant record injection in Roskus Prospero Flow CRM before 5.14.0 allows any authenticated user to silently insert
Tenant data boundary failure in Roskus Prospero Flow CRM 4.9.1-5.14.0 allows authenticated users holding transaction and
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today