Prospero Flow CRM EUVD-2026-55618

Exploitation requires a valid authenticated session in Prospero Flow CRM - any role qualifies, as the endpoint imposes no role-based gate in the vulnerable version. The attacker must supply a valid role ID in the POST body; role IDs are integer primary keys and are likely enumerable via sequential guessing or visible within the UI. No non-default configuration, special feature enablement, or co-located system access is required. What limits exploitation is the requirement for at least one authenticated account - unauthenticated external attackers cannot reach this endpoint without first compromising credentials. Once credentials are obtained (e.g., via phishing, credential stuffing, or insider access), exploitation is a single HTTP request with no further prerequisites.

The CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) accurately reflects the threat: network-accessible, low-complexity exploitation requiring only a valid authenticated session, with high impact on confidentiality, integrity, and availability of the vulnerable system. The attack is effectively a one-request privilege escalation - no chaining, no brute force, no race condition. EPSS data was not provided in the source intelligence, so exploitation probability cannot be numerically assessed. The absence of a CISA KEV listing means active exploitation has not been formally confirmed by CISA, and no standalone public POC has been identified. However, the commit diff is publicly visible on GitHub and documents the exact endpoint path, the missing authorization step, and the POST body structure - a motivated attacker with CRM credentials can derive a working exploit from this alone. Risk is highest in deployments with multiple low-trust authenticated users (e.g., customer-facing portals, sales team installations with contractor accounts). This is a genuine priority for any organization running the affected version; the low exploitation complexity and high impact make the high CVSS score appropriate rather than inflated.

An attacker with a low-privileged CRM account (e.g., a sales representative or contractor) sends a single crafted POST request to the /permission save endpoint with a JSON body mapping their own role's integer ID to an array of all available permission names. The vulnerable controller passes this directly to syncPermissions() without consulting any authorization gate, instantly persisting the full permission set to the targeted role. The attacker's account now operates with SuperAdmin-equivalent privileges across the entire CRM, including access to all customer records, system configuration, and user management functions.