Prospero Flow CRM CVE-2026-82911

The victim must be authenticated to the Prospero Flow CRM application at the time of exploitation (an active, valid session cookie must be present). The victim must perform a top-level browser navigation to the attacker-controlled URL - a direct link click is sufficient; no file download, plugin execution, or secondary confirmation is required. SameSite=Lax must be the session cookie policy (the default in modern frameworks including Laravel), which allows cookies on top-level navigations. Sequential order numbers mean no enumeration of valid order IDs is needed beyond guessing a range. Limiting factors: the attack requires social engineering to deliver the crafted URL to a logged-in user; if the organization enforces SameSite=Strict cookies, cross-site navigation cookies are blocked and the attack fails; the attacker cannot read any response data (no confidentiality impact), only trigger the state change.

The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N, score 5.1) is well-calibrated to the actual impact. The integrity impact is limited to a single order state change per click, but the sequential order number scheme allows an attacker who can induce repeated clicks - or who chains this with an open redirect - to systematically confirm all pending orders, amplifying the effective impact beyond what the VI:L metric alone suggests. User interaction is a genuine prerequisite (UI:A), which reduces automatable risk versus pure network-accessible CSRF with no required click. No KEV listing or published PoC exists at time of analysis; the EPSS signal is not provided. Real-world risk is moderate for any organization using this CRM for order management, as mass-confirming orders without authorization can result in financial or fulfilment fraud. The niche footprint of this product limits broad exposure.

An attacker targets an organization's order management workflow by crafting a URL such as https://crm.example.com/order/confirm/1042 and embedding it in a phishing email or malicious web page. When an authenticated CRM user clicks the link, the browser performs a top-level GET navigation and automatically attaches the SameSite=Lax session cookie, causing OrderConfirmController::confirm() to execute and mark order 1042 as confirmed without the user's intent. By iterating over sequential order numbers (e.g., 1-9999) in embedded image tags or iframes using a zero-pixel technique or JavaScript redirect loop, the attacker could confirm all pending orders in a single page load by the victim. No public exploit code is identified at time of analysis.