CVE-2026-82911: CSRF in Prospero Flow CRM order confirmation allows unauthorized order state changes
Cross-Site Request Forgery (CSRF) in the OrderConfirmController at GET /order/confirm/{ordernumber} in Roskus Prospero Flow CRM before 5.15.11 allows an unauthenticated attacker to confirm any order on behalf of an authenticated user by directing them to a crafted page. Laravel's VerifyCsrfToken middleware enforces CSRF tokens only on POST, PUT, PATCH, and DELETE requests; the Route::get declaration leaves this state-changing action unprotected. Session cookies configured with SameSite=Lax are automatically included in top-level cross-site navigation, so a single link click triggers OrderConfirmController::confirm() and transitions the target order from pending to confirmed without user authorization. Because order numbers are sequential integers, an attacker can enumerate and confirm all existing orders in a single automated sweep.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Roskus Prospero Flow CRMto a version that resolves this vulnerability.Fixed in 5.15.11 - Compensating control
Restrict access to the GET endpoint /order/confirm/{order_number} (OrderConfirmController::confirm) so it cannot be triggered via cross-site navigation (e.g., block/limit cross-site requests through network controls or by isolating the route behind an additional authorization check).
Event History
Frequently Asked Questions
Which deployments are affected?
Roskus Prospero Flow CRM versions before 5.15.11 are affected. The vulnerable order-confirmation action is exposed through a GET request, so deployments using the affected route can be triggered through a cross-site top-level navigation.
What must an attacker do to confirm an order?
The attacker needs to induce an authenticated user to follow a crafted link or visit a crafted page targeting /order/confirm/{order_number}. No CSRF token is required because the state-changing action is declared as GET, and SameSite=Lax session cookies are included with top-level cross-site navigation.
Can an attacker target orders other than the victim's own order?
Yes. The affected endpoint accepts an order number, and the described sequential integer order numbers allow attackers to enumerate targets and attempt to confirm existing orders in an automated sweep.
What can be done if updating is not immediately possible?
Restrict or disable access to the GET order-confirmation route until a fix can be applied. A durable remediation is to avoid using GET for state-changing actions and require CSRF validation for order confirmation.