CVE-2026-59233

Missing Authorization in the permission management component in Roskus Prospero Flow CRM before 5.2.1 allows any authenticated user to grant any role, including their own, the complete set of application permissions via a crafted POST request to the permission save endpoint, which performs no authorization check before synchronizing the submitted permissions to the specified role.

CVSS

No CVSS.

References

Link	Resource
https://github.com/Roskus/prospero-flow-crm/commit/86a7d6557bd111518a221f4575ad6e36087e19d3
https://github.com/Roskus/prospero-flow-crm/releases/tag/v5.5.3
https://secur0.com/en/cna/cve-list/cve-2026-59233-missing-authorization-in-prospero-flow-crm-permission-endpoint

Configurations

No configuration.

History

23 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) Falta de autorización en el componente de gestión de permisos en Roskus Prospero Flow CRM anterior a 5.2.1 permite a cualquier usuario autenticado otorgar cualquier rol, incluido el suyo propio, el conjunto completo de permisos de la aplicación mediante una solicitud POST manipulada al endpoint de guardado de permisos, que no realiza ninguna comprobación de autorización antes de sincronizar los permisos enviados al rol especificado.

Information

Published : 2026-08-10 13:19

Updated : 2026-10-24 16:10

NVD link : CVE-2026-59233

Mitre link : CVE-2026-59233

CVE.ORG link : CVE-2026-59233

JSON object : View

Products Affected

No product.

CWE

CWE-639

Authorization Bypass Through User-Controlled Key

{"id": "CVE-2026-59233", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-59233", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-10T17:52:31.556651Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "4daa8cea-433a-44bd-9456-53b127fc289a", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "4daa8cea-433a-44bd-9456-53b127fc289a", "affectedData": [{"repo": "https://github.com/Roskus/prospero-flow-crm", "vendor": "Roskus", "modules": ["Permission management"], "product": "Prospero Flow CRM", "versions": [{"status": "affected", "version": "0", "lessThan": "5.2.1", "versionType": "semver"}], "programFiles": ["app/Http/Controllers/Permission/PermissionSaveController.php", "routes/web.php"], "defaultStatus": "unaffected"}]}], "published": "2026-08-10T13:19:51.713", "references": [{"url": "https://github.com/Roskus/prospero-flow-crm/commit/86a7d6557bd111518a221f4575ad6e36087e19d3", "source": "4daa8cea-433a-44bd-9456-53b127fc289a"}, {"url": "https://github.com/Roskus/prospero-flow-crm/releases/tag/v5.5.3", "source": "4daa8cea-433a-44bd-9456-53b127fc289a"}, {"url": "https://secur0.com/en/cna/cve-list/cve-2026-59233-missing-authorization-in-prospero-flow-crm-permission-endpoint", "source": "4daa8cea-433a-44bd-9456-53b127fc289a"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "4daa8cea-433a-44bd-9456-53b127fc289a", "description": [{"lang": "en", "value": "CWE-639"}]}], "descriptions": [{"lang": "en", "value": "Missing Authorization in the permission management component in Roskus Prospero Flow CRM before 5.2.1 allows any authenticated user to grant any role, including their own, the complete set of application permissions via a crafted POST request to the permission save endpoint, which performs no authorization check before synchronizing the submitted permissions to the specified role."}, {"lang": "es", "value": "Falta de autorizaci\u00f3n en el componente de gesti\u00f3n de permisos en Roskus Prospero Flow CRM anterior a 5.2.1 permite a cualquier usuario autenticado otorgar cualquier rol, incluido el suyo propio, el conjunto completo de permisos de la aplicaci\u00f3n mediante una solicitud POST manipulada al endpoint de guardado de permisos, que no realiza ninguna comprobaci\u00f3n de autorizaci\u00f3n antes de sincronizar los permisos enviados al rol especificado."}], "lastModified": "2026-10-24T16:10:00.153", "sourceIdentifier": "4daa8cea-433a-44bd-9456-53b127fc289a"}