What’s Vulnerable › Vulnerabilities

CVE-2026-59233: Missing Authorization in Prospero Flow CRM permission save endpoint allows privilege escalation

• Severity: high (CVSS 8.7 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-10 · updated 2026-10-24
• Weakness: CWE-639

Description

Missing Authorization in the permission management component in Roskus Prospero Flow CRM before 5.2.1 allows any authenticated user to grant any role, including their own, the complete set of application permissions via a crafted POST request to the permission save endpoint, which performs no authorization check before synchronizing the submitted permissions to the specified role.

Affected products

• Roskus Prospero Flow CRM: before 5.2.1 — fixed in 5.2.1

How to fix

Upgrade to a fixed version: Roskus Prospero Flow CRM 5.2.1. Check the vendor advisory for mitigations.

References

• https://github.com/Roskus/prospero-flow-crm/commit/86a7d6557bd111518a221f4575ad6e36087e19d3
• https://github.com/Roskus/prospero-flow-crm/releases/tag/v5.5.3
• https://secur0.com/en/cna/cve-list/cve-2026-59233-missing-authorization-in-prospero-flow-crm-permission-endpoint

Get alerted when CVE-2026-59233 or the next vulnerability affects your stack