Skip to content
Secur0
Solutions
View all AI Agent Security New Protect your AI agents Vulnerability Disclosure Secure reporting channel Penetration Testing Expert manual audits Crowdsourced Pentest Thousands of hackers, one goal Bug Bounty Success-based payment Live Hacking Live real-time pentesting For company teams Train your technical team For educational centers Bring hacking to the classroom For hackers Learn and get certified Competitions / CTFs Put your skills to the test
Customer Stories
View all Penetration Testing Manual pentesting VDP Secure reporting channel Pentest In-depth audits Crowdsourced Pentest Thousands of hackers, one goal Bug Bounty Success-based payment
Resources
About Secur0 Get to know us Jobs Join the team Media Kit Brand resources Contact Talk to us Newsletter Industry news Blog Articles and guides Partners Join the partner network We are a CNA We are a CVE Numbering Authority
Are you a hacker?
Request a demo Log in
Español English
Back to list
CVE-2026-82911 ·
Medium · September 4, 2026

CSRF in Prospero Flow CRM order confirmation allows unauthorized order state changes

S0
Secur0 CNA
CVE-2026-82911

Description

Cross-Site Request Forgery (CSRF) in OrderConfirmController::confirm() (app/Http/Controllers/Order/OrderConfirmController.php), exposed at GET /order/confirm/{order_number}, in Prospero Flow CRM before 5.15.11, which allows an unauthenticated attacker to confirm any order on behalf of an authenticated user by inducing them to visit a malicious page containing a crafted link or navigation element. Laravel's VerifyCsrfToken middleware enforces CSRF token validation only on POST, PUT, PATCH, and DELETE requests, while the Route::get declaration for this state-changing action is left entirely unprotected. Session cookies configured with SameSite=Lax are automatically included in top-level cross-site navigations (for example, when clicking a link), meaning a single click on an attacker-controlled link triggers OrderConfirmController::confirm() and transitions the target order from pending to confirmed without user authorization. Because order numbers are sequential and predictable integers, an attacker can enumerate and confirm all existing orders on the platform in a single automated sweep.

Vulnerability type (CWE)

CWE-352: Cross-Site Request Forgery (CSRF)

Affected versions

Prospero Flow CRM in all versions before 5.15.11. The vulnerable route Route::get('/order/confirm/{id}', ...) is present since tag v1.0.0 (June 2, 2024) and in all subsequently published tags: v2.0.1, v4.6.0, v5.5.3 and v5.14.0. The fixed version 5.15.11 is not tagged and no published release carries the fix. Default status: unaffected.

Score (CVSS 4.0)

Medium (5.1)

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Solution

Upgrade to version 5.15.11 or later by deploying from the main branch: the fix has not been tagged and the latest available release, v5.14.0, does not carry it. The fix converts the route from Route::get to Route::post and adds a @csrf token to the order confirmation form in resources/views/order/index.blade.php.

Patch

Commit a90c0c8c

Credits

  • Darío Chacón - finder
  • Mario Álvarez - finder
  • Darío Rivas Quero - analyst
  • Cristian Fernández Cornejo - analyst
  • Secur0 CNA - coordinator
  • Gustavo Novaro - remediation developer

Discovery source: External

Official record: CVE-2026-82911