CVE-2026-82911: CSRF in Prospero Flow CRM order confirmation allows unauthorized order state changes

Severity: medium (CVSS 5.1 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-04 · updated 2026-09-09
Weakness: CWE-352

Description

Cross-Site Request Forgery (CSRF) in the OrderConfirmController at GET /order/confirm/{order_number} in Roskus Prospero Flow CRM before 5.15.11 allows an unauthenticated attacker to confirm any order on behalf of an authenticated user by directing them to a crafted page. Laravel's VerifyCsrfToken middleware enforces CSRF tokens only on POST, PUT, PATCH, and DELETE requests; the Route::get declaration leaves this state-changing action unprotected. Session cookies configured with SameSite=Lax are automatically included in top-level cross-site navigation, so a single link click triggers OrderConfirmController::confirm() and transitions the target order from pending to confirmed without user authorization. Because order numbers are sequential integers, an attacker can enumerate and confirm all existing orders in a single automated sweep.

Affected products

Roskus Prospero Flow CRM: before 5.15.11 — fixed in 5.15.11

How to fix

Upgrade to a fixed version: Roskus Prospero Flow CRM 5.15.11. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-82911 or the next vulnerability affects your stack