CVE-2026-59233

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-59233", "assignerOrgId": "4daa8cea-433a-44bd-9456-53b127fc289a", "state": "PUBLISHED", "assignerShortName": "Secur0", "dateReserved": "2026-07-03T11:24:39.241Z", "datePublished": "2026-08-10T12:14:40.002Z", "dateUpdated": "2026-08-10T17:52:43.950Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "4daa8cea-433a-44bd-9456-53b127fc289a", "shortName": "Secur0", "dateUpdated": "2026-08-10T12:14:40.002Z"}, "title": "Missing Authorization in Prospero Flow CRM permission save endpoint allows privilege escalation", "datePublic": "2026-08-10T12:09:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-639", "description": "CWE-639 Authorization bypass through User-Controlled key", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-1", "descriptions": [{"lang": "en", "value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"}]}], "affected": [{"vendor": "Roskus", "product": "Prospero Flow CRM", "repo": "https://github.com/Roskus/prospero-flow-crm", "modules": ["Permission management"], "programFiles": ["app/Http/Controllers/Permission/PermissionSaveController.php", "routes/web.php"], "versions": [{"status": "affected", "version": "0", "lessThan": "5.2.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "cpeApplicability": [{"operator": "OR", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:roskus:prospero_flow_crm:*:*:*:*:*:*:*:*", "versionStartIncluding": "0", "versionEndExcluding": "5.2.1"}]}]}], "descriptions": [{"lang": "en", "value": "Missing Authorization in the permission management component in Roskus Prospero Flow CRM before 5.2.1 allows any authenticated user to grant any role, including their own, the complete set of application permissions via a crafted POST request to the permission save endpoint, which performs no authorization check before synchronizing the submitted permissions to the specified role.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Missing Authorization in the permission management component in Roskus Prospero Flow CRM before 5.2.1 allows any authenticated user to grant any role, including their own, the complete set of application permissions via a crafted POST request to the permission save endpoint, which performs no authorization check before synchronizing the submitted permissions to the specified role."}]}], "tags": ["x_open-source"], "references": [{"url": "https://github.com/Roskus/prospero-flow-crm/commit/86a7d6557bd111518a221f4575ad6e36087e19d3", "tags": ["patch"]}, {"url": "https://github.com/Roskus/prospero-flow-crm/releases/tag/v5.5.3", "tags": ["release-notes"]}, {"url": "https://secur0.com/en/cna/cve-list/cve-2026-59233-missing-authorization-in-prospero-flow-crm-permission-endpoint", "tags": ["technical-description"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "HIGH", "baseScore": 8.7, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}}], "solutions": [{"lang": "en", "value": "Upgrade to version 5.2.1 or higher.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Upgrade to version 5.2.1 or higher."}]}], "credits": [{"lang": "en", "value": "k1di3", "type": "finder"}, {"lang": "en", "value": "Cristian Fern\u00e1ndez Cornejo", "type": "analyst"}, {"lang": "en", "value": "Xo\u00e1n M. Otero Jorge", "type": "analyst"}, {"lang": "en", "value": "Secur0 CNA", "type": "coordinator"}, {"lang": "en", "value": "Gustavo Novaro", "type": "remediation developer"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 1.0.4"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-10T17:52:31.556651Z", "id": "CVE-2026-59233", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-10T17:52:43.950Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-59233", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-08-10T17:52:31.556651Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-10T17:52:38.170Z"}}], "cna": {"tags": ["x_open-source"], "title": "Missing Authorization in Prospero Flow CRM permission save endpoint allows privilege escalation", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "k1di3"}, {"lang": "en", "type": "analyst", "value": "Cristian Fern\u00e1ndez Cornejo"}, {"lang": "en", "type": "analyst", "value": "Xo\u00e1n M. Otero Jorge"}, {"lang": "en", "type": "coordinator", "value": "Secur0 CNA"}, {"lang": "en", "type": "remediation developer", "value": "Gustavo Novaro"}], "impacts": [{"capecId": "CAPEC-1", "descriptions": [{"lang": "en", "value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/Roskus/prospero-flow-crm", "vendor": "Roskus", "modules": ["Permission management"], "product": "Prospero Flow CRM", "versions": [{"status": "affected", "version": "0", "lessThan": "5.2.1", "versionType": "semver"}], "programFiles": ["app/Http/Controllers/Permission/PermissionSaveController.php", "routes/web.php"], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Upgrade to version 5.2.1 or higher.", "supportingMedia": [{"type": "text/html", "value": "Upgrade to version 5.2.1 or higher.", "base64": false}]}], "datePublic": "2026-08-10T12:09:00.000Z", "references": [{"url": "https://github.com/Roskus/prospero-flow-crm/commit/86a7d6557bd111518a221f4575ad6e36087e19d3", "tags": ["patch"]}, {"url": "https://github.com/Roskus/prospero-flow-crm/releases/tag/v5.5.3", "tags": ["release-notes"]}, {"url": "https://secur0.com/en/cna/cve-list/cve-2026-59233-missing-authorization-in-prospero-flow-crm-permission-endpoint", "tags": ["technical-description"]}], "x_generator": {"engine": "Vulnogram 1.0.4"}, "descriptions": [{"lang": "en", "value": "Missing Authorization in the permission management component in Roskus Prospero Flow CRM before 5.2.1 allows any authenticated user to grant any role, including their own, the complete set of application permissions via a crafted POST request to the permission save endpoint, which performs no authorization check before synchronizing the submitted permissions to the specified role.", "supportingMedia": [{"type": "text/html", "value": "Missing Authorization in the permission management component in Roskus Prospero Flow CRM before 5.2.1 allows any authenticated user to grant any role, including their own, the complete set of application permissions via a crafted POST request to the permission save endpoint, which performs no authorization check before synchronizing the submitted permissions to the specified role.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-639", "description": "CWE-639 Authorization bypass through User-Controlled key"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:roskus:prospero_flow_crm:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.2.1", "versionStartIncluding": "0"}], "operator": "OR"}], "operator": "OR"}], "providerMetadata": {"orgId": "4daa8cea-433a-44bd-9456-53b127fc289a", "shortName": "Secur0", "dateUpdated": "2026-08-10T12:14:40.002Z"}}}, "cveMetadata": {"cveId": "CVE-2026-59233", "state": "PUBLISHED", "dateUpdated": "2026-08-10T17:52:43.950Z", "dateReserved": "2026-07-03T11:24:39.241Z", "assignerOrgId": "4daa8cea-433a-44bd-9456-53b127fc289a", "datePublished": "2026-08-10T12:14:40.002Z", "assignerShortName": "Secur0"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "modules": ["Permission management"], "product": "Prospero Flow CRM", "programFiles": ["app/Http/Controllers/Permission/PermissionSaveController.php", "routes/web.php"], "repo": "https://github.com/Roskus/prospero-flow-crm", "vendor": "Roskus", "versions": [{"lessThan": "5.2.1", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "4daa8cea-433a-44bd-9456-53b127fc289a"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Missing Authorization in the permission management component in Roskus Prospero Flow CRM before 5.2.1 allows any authenticated user to grant any role, including their own, the complete set of application permissions via a crafted POST request to the permission save endpoint, which performs no authorization check before synchronizing the submitted permissions to the specified role."}, {"lang": "es", "value": "Falta de autorizaci\u00f3n en el componente de gesti\u00f3n de permisos en Roskus Prospero Flow CRM anterior a 5.2.1 permite a cualquier usuario autenticado otorgar cualquier rol, incluido el suyo propio, el conjunto completo de permisos de la aplicaci\u00f3n mediante una solicitud POST manipulada al endpoint de guardado de permisos, que no realiza ninguna comprobaci\u00f3n de autorizaci\u00f3n antes de sincronizar los permisos enviados al rol especificado."}], "id": "CVE-2026-59233", "lastModified": "2026-10-24T16:10:00.153", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "4daa8cea-433a-44bd-9456-53b127fc289a", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-59233", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-08-10T17:52:31.556651Z", "version": "2.0.3"}}]}, "published": "2026-08-10T13:19:51.713", "references": [{"source": "4daa8cea-433a-44bd-9456-53b127fc289a", "url": "https://github.com/Roskus/prospero-flow-crm/commit/86a7d6557bd111518a221f4575ad6e36087e19d3"}, {"source": "4daa8cea-433a-44bd-9456-53b127fc289a", "url": "https://github.com/Roskus/prospero-flow-crm/releases/tag/v5.5.3"}, {"source": "4daa8cea-433a-44bd-9456-53b127fc289a", "url": "https://secur0.com/en/cna/cve-list/cve-2026-59233-missing-authorization-in-prospero-flow-crm-permission-endpoint"}], "sourceIdentifier": "4daa8cea-433a-44bd-9456-53b127fc289a", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-639"}], "source": "4daa8cea-433a-44bd-9456-53b127fc289a", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,5.2.1)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Prospero Flow CRM", "source": "cna", "vendor": "Roskus"}, "product": "prospero_flow_crm", "vendor": "roskus"}], "created": "2026-08-10T13:30:05.188109+00:00", "updated": "2026-08-10T15:30:05.717494+00:00", "vendors": ["roskus", "roskus$PRODUCT$prospero_flow_crm"]}