CVE-2026-59233CWE-639

CVE-2026-59233

published August 10, 2026

CVSS
8.7
EPSS
0%
Percentile
34.6
In the wild
Unconfirmed
What it is

Missing Authorization in the permission management component in Roskus Prospero Flow CRM before 5.2.1 allows any authenticated user to grant any role, including their own, the complete set of application permissions via a crafted POST request to the permission save endpoint, which performs no authorization check before synchronizing the submitted permissions to the specified role.

The record
Technical detail
CVSS
8.7 · NONE
CVSS v4.0
Not supplied
EPSS
0.00414 · 34.6th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-08-10T17:19Z
References (3)
https://github.com/Roskus/prospero-flow-crm/commit/86a7d6557bd111518a221f4575ad6e36087e19d3 · 4daa8cea-433a-44bd-9456-53b127fc289ahttps://github.com/Roskus/prospero-flow-crm/releases/tag/v5.5.3 · 4daa8cea-433a-44bd-9456-53b127fc289ahttps://secur0.com/en/cna/cve-list/cve-2026-59233-missing-authorization-in-prospero-flow-crm-permission-endpoint · 4daa8cea-433a-44bd-9456-53b127fc289a
EPSS history
Timeline
  • 10 AUG 12:14Z
    Missing Authorization in Prospero Flow CRM permission save endpoint allows privilege escalation
    cvelistv5