CVE-2026-59239: Prospero Flow CRM 1.0.0 to before 5.4.4

Affected technology

Prospero Flow CRM · 1.0.0 to before 5.4.4
Roskus

Description’s affected range: before 5.4.4

Component: Email module
Function: EmailCreateService
File: app/Services/EmailCreateService.php, resources/views/email/view.blade.php, app/Http/Controllers/Profile/ProfileSaveController.php

Attack conditions (Source advisory, CVSS 4.0): Network (remote) · No privileges required · Passive user interaction

What an attacker can do

A remote, authenticated low-privileged user can execute arbitrary JavaScript in another user's browser, including administrators, leading to session compromise and account takeover, via a payload stored in an email body that is persisted without sanitization and rendered unescaped with {!! $email->body !!} when the recipient opens the message. Source advisory’s CVSS 4.0 assessment (base score 8.6/10) rates confidentiality and integrity impact as high; availability impact as none.