Skip to content
Secur0
Solutions
View all AI Agent Security New Protect your AI agents Vulnerability Disclosure Secure reporting channel Penetration Testing Expert manual audits Crowdsourced Pentest Thousands of hackers, one goal Bug Bounty Success-based payment Live Hacking Live real-time pentesting For company teams Train your technical team For educational centers Bring hacking to the classroom For hackers Learn and get certified Competitions / CTFs Put your skills to the test
Customer Stories
View all Penetration Testing Manual pentesting VDP Secure reporting channel Pentest In-depth audits Crowdsourced Pentest Thousands of hackers, one goal Bug Bounty Success-based payment
Resources
About Secur0 Get to know us Jobs Join the team Media Kit Brand resources Contact Talk to us Newsletter Industry news Blog Articles and guides Partners Join the partner network We are a CNA We are a CVE Numbering Authority
Are you a hacker?
Request a demo Log in
Español English
Back to list
CVE-2026-59233 ·
High · August 10, 2026

Missing Authorization in Prospero Flow CRM allows any authenticated user to escalate privileges via the permission save endpoint

S0
Secur0 CNA
CVE-2026-59233

Description

Missing Authorization (CWE-639) in PermissionSaveController (app/Http/Controllers/Permission/PermissionSaveController.php), exposed at POST /permission, in Prospero Flow CRM 5.2.0, which allows any authenticated user, regardless of role, to reassign the complete permission set of any role in the system, including their own, via a request submitting the roles[<role_id>][] array with the desired permissions, because neither the route nor the controller applied any authorization check: the route is declared in routes/web.php with no ->can() and no middleware('permission:...'), the save() method received a generic Illuminate\Http\Request with no authorize() and ran Role::findById($role_id)->syncPermissions($permissions) directly on request input, unlike every other route in the project, which does declare its required permission (for example ->can('create lead') in routes/module/lead.php or middleware('permission:read company|update company') on the /setting route). This results in full vertical privilege escalation: the supplied proof of concept, run from an account holding the Seller role, assigns that role all 38 permissions defined in the application, including create user, delete user, delete company, bank card view number and bank card view cvv, and verifies the change by comparing the response codes of /user/create, /supplier and /lead/delete/{id} before and after the request.

Vulnerability type (CWE)

CWE-639 Authorization bypass through User-Controlled key

Affected versions

Prospero Flow CRM before 5.2.1 (fixed in 5.2.1 by commit 86a7d655, dated 2026-06-20). The endpoint was introduced along with the permissions dashboard in commit ac1919b7 (2023-03-24), at version 2.2.11, and was present without authorization in the v1.0.0, v2.0.1 and v4.6.0 tags, so tagged releases did ship in a vulnerable state. Version 5.2.1 carries no git tag: the earliest tag containing the fix is v5.5.3. Versions are read from the APP_VERSION constant in version.php. Default status: unaffected.

Score (CVSS 4.0)

High (Alta)

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Solution

Upgrade to version 5.2.1 or higher. The fix was not tagged: the earliest tagged release containing it is v5.5.3.

Patch

Commit 86a7d655

Credits

  • k1di3 - finder
  • Cristian Fernández Cornejo - analyst
  • Xoán M. Otero Jorge - analyst
  • Secur0 CNA - coordinator
  • Gustavo Novaro - remediation developer Discovery source: External Official record: CVE-2026-59233