Stored Cross-Site Scripting Vulnerability in Roskus Prospero Flow CRM

CVE-2026-59239

What is CVE-2026-59239?

A vulnerability exists in the email module of Roskus Prospero Flow CRM, allowing a remote, authenticated low-privileged user to inject arbitrary JavaScript code into an email body. This code is stored unsanitized and executed when the recipient, including administrators, opens the email. The exploitation of this flaw can lead to session hijacking and unauthorized access to user accounts, posing a significant security risk to the affected system.

References