Vulnerability Description
Missing Authorization in the permission management component in Roskus Prospero Flow CRM before 5.2.1 allows any authenticated user to grant any role, including their own, the complete set of application permissions via a crafted POST request to the permission save endpoint, which performs no authorization check before synchronizing the submitted permissions to the specified role.
Related Weaknesses (CWE)
References
- https://github.com/Roskus/prospero-flow-crm/commit/86a7d6557bd111518a221f4575ad6
- https://github.com/Roskus/prospero-flow-crm/releases/tag/v5.5.3
- https://secur0.com/en/cna/cve-list/cve-2026-59233-missing-authorization-in-prosp
FAQ
What is CVE-2026-59233?
CVE-2026-59233 is a documented vulnerability. Missing Authorization in the permission management component in Roskus Prospero Flow CRM before 5.2.1 allows any authenticated user to grant any role, including their own, the complete set of applicat...
How severe is CVE-2026-59233?
CVSS scoring is not yet available for CVE-2026-59233. Check NVD for updates.
Is there a patch for CVE-2026-59233?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.