Missing Authorization in Roskus Prospero Flow CRM Permissions Component

CVE-2026-59233

What is CVE-2026-59233?

The permission management component in Roskus Prospero Flow CRM prior to version 5.2.1 is susceptible to a missing authorization flaw. This vulnerability allows authenticated users to exploit the system by sending a specially crafted POST request to the permission save endpoint. Without proper authorization checks, users can manipulate roles and permissions, granting themselves or others extensive application rights. Such a security oversight can lead to unauthorized access and potential misuse of application functionalities.

References