Skip to content
Secur0
Solutions
AI Agent Security New Protect your AI agents Vulnerability Disclosure Secure reporting channel Penetration Testing Expert manual audits Crowdsourced Pentest Thousands of hackers, one goal Bug Bounty Success-based payment Live Hacking Live real-time pentesting For company teams Train your technical team For educational centers Bring hacking to the classroom For hackers Learn and get certified Competitions / CTFs Put your skills to the test
Customer Stories
Edtech Success in education Penetration Testing Manual pentesting VDP Secure reporting channel Pentest In-depth audits Crowdsourced Pentest Thousands of hackers, one goal Bug Bounty Success-based payment
Resources
About Secur0 Get to know us Careers Join the team Media Kit Brand resources Contact Talk to us Newsletter Industry news Blog Articles and guides Partners Join the partner network We are a CNA We are a CVE Numbering Authority
Are you a hacker?
Request a demo Log in
Español English
Back to list
CVE-2026-59239 ·
High · July 27, 2026

Stored XSS in Prospero Flow CRM email body allows administrator account takeover

S0
Secur0 CNA
CVE-2026-59239

Description

Stored Cross-site Scripting (CWE-79) in the email module (EmailCreateService, app/Services/EmailCreateService.php, and EmailRequest, app/Http/Requests/EmailRequest.php), whose content is rendered unescaped in resources/views/email/view.blade.php via {!! $email->body !!}, in Prospero Flow CRM <5.4.4, which allows a remote, authenticated low-privileged attacker (for example, a user with a sales role) to execute arbitrary JavaScript in another user's browser, including administrators, by storing a payload in the body of an email sent to the victim, because the message body was persisted without any sanitization and the view interpolated it as unescaped HTML. The same flaw affected the user profile signature_html field, which was stored unsanitized in ProfileSaveController. Execution requires a single victim interaction, opening the email, and results in compromise of the victim's session and takeover of their account.

Vulnerability type (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation (Cross-site Scripting)

Affected versions

Prospero Flow CRM before 5.4.4 (all versions prior to 5.4.4). The flaw has been present since 1.0.0 and was fixed in 5.4.4. Default status: unaffected.

Score (CVSS 4.0)

High

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:L/SA:N

Solution

Upgrade to version 5.4.4 or higher.

Patch

Commit 32efcd5c

Credits

  • Robert Mihaila - finder
  • Amirreza Fadaeizadeh Bidari - finder
  • Cristian Fernandez Cornejo - analyst
  • Xoán M. Otero Jorge - analyst
  • Secur0 CNA - coordinator
  • Gustavo Novaro - remediation developer Discovery source: External Official record: CVE-2026-59239