High severity · published Aug 10, 2026
CVE-2026-59233
Missing Authorization in Prospero Flow CRM permission save endpoint allows privilege escalation
8.7
CVSS
0.4%
EPSS
No
On KEV
Description
Missing Authorization in the permission management component in Roskus Prospero Flow CRM before 5.2.1 allows any authenticated user to grant any role, including their own, the complete set of application permissions via a crafted POST request to the permission save endpoint, which performs no authorization check before synchronizing the submitted permissions to the specified role.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 35% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PF
Prospero Flow CRM · Roskus
before 5.2.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-59233
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-59233
github.com
https://github.com/Roskus/prospero-flow-crm/commit/86a7d6557bd111518a221f4575ad6e36087e19d3
github.com
https://github.com/Roskus/prospero-flow-crm/releases/tag/v5.5.3
secur0.com
https://secur0.com/en/cna/cve-list/cve-2026-59233-missing-authorization-in-prospero-flow-crm-permission-endpoint
More from Prospero Flow CRM
9.3
CVE-2026-78365
IDOR and missing authorization in Prospero Flow CRM supplier API allows cross-tenant read and modification
9.3
CVE-2026-19871
Use of hard-coded credentials in Prospero Flow CRM employee onboarding
8.7
CVE-2026-77759
IDOR and missing authorization in the Prospero Flow CRM transaction API allow cross-tenant reading of financial records
8.7
CVE-2026-59235
Missing authorization in Prospero Flow CRM allows low-privileged users to read all bank accounts
8.6
CVE-2026-114519
Missing authorization in the Prospero Flow CRM user API allows a basic role user to read and delete other accounts