CVE-2026-59233: Prospero Flow CRM 0 to before 5.2.1

Affected technology

Prospero Flow CRM · 0 to before 5.2.1
Roskus

Description’s affected range: before 5.2.1

Component: Permission management
File: app/Http/Controllers/Permission/PermissionSaveController.php, routes/web.php

Attack conditions (Source advisory, CVSS 4.0): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

Any authenticated user can grant any role, including their own, the complete set of application permissions via a crafted POST request to the permission save endpoint, which performs no authorization check before synchronizing the submitted permissions to the specified role. Source advisory’s CVSS 4.0 assessment (base score 8.7/10) rates confidentiality, integrity and availability impact as high.