Vulnerability · Published Aug 10, 2026 · Assigned by Secur0
CVE-2026-59233Missing Authorization in Prospero Flow CRM permission save endpoint allows privilege escalation
High 8.7
In plain English
A high-severity authorization bypass via user-controlled key in Prospero Flow CRM from Roskus. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities).
Official description
Missing Authorization in the permission management component in Roskus Prospero Flow CRM before 5.2.1 allows any authenticated user to grant any role, including their own, the complete set of application permissions via a crafted POST request to the permission save endpoint, which performs no authorization check before synchronizing the submitted permissions to the specified role.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Roskus | Prospero Flow CRM | 0 – before 5.2.1 |
Weakness: CWE-639 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References
- https://github.com/Roskus/prospero-flow-crm/commit/86a7d6557bd111518a221f4575ad6e36087e19d3 patch
- https://github.com/Roskus/prospero-flow-crm/releases/tag/v5.5.3 release-notes
- https://secur0.com/en/cna/cve-list/cve-2026-59233-missing-authorization-in-prospero-flow-crm-permission-endpoint technical-description