CVE-2026-82911 Details
Description
Cross-Site Request Forgery (CSRF) in the OrderConfirmController at GET /order/confirm/{order_number} in Roskus Prospero Flow CRM before 5.15.11 allows an unauthenticated attacker to confirm any order on behalf of an authenticated user by directing them to a crafted page. Laravel's VerifyCsrfToken middleware enforces CSRF tokens only on POST, PUT, PATCH, and DELETE requests; the Route::get declaration leaves this state-changing action unprotected. Session cookies configured with SameSite=Lax are automatically included in top-level cross-site navigation, so a single link click triggers OrderConfirmController::confirm() and transitions the target order from pending to confirmed without user authorization. Because order numbers are sequential integers, an attacker can enumerate and confirm all existing orders in a single automated sweep.
A Cross-Site Request Forgery (CSRF) vulnerability has been identified in Roskus Prospero Flow CRM versions prior to 5.15.11. The issue resides in the OrderConfirmController, specifically within the GET /order/confirm/{order_number} endpoint. This vulnerability allows an unauthenticated attacker to confirm orders on behalf of authenticated users by directing them to a malicious page. The vulnerability exists because Laravel's VerifyCsrfToken middleware only protects POST, PUT, PATCH, and DELETE requests, leaving this state-changing action unguarded. With session cookies set to SameSite=Lax, a single click on a crafted link can trigger the order confirmation process, changing the order status from pending to confirmed without proper authorization. Additionally, the sequential nature of order numbers enables attackers to automate the confirmation of multiple orders in one go.
Users are advised to upgrade to version 5.15.11 or later. The fix has been implemented in the main branch, but this version is not yet tagged. The latest tagged version, 5.14.0, does not include the fix.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 4, 2026CISA-ADP
Assessed Sep 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Roskus/prospero-flow-crm/commit/a90c0c8c | Secur0 | Source CodeVendor |
| https://secur0.com/en/cna/cve-list/cve-2026-82911-csrf-order-confirmation-prospero-flow-crm | Secur0 | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-352 | Cross-Site Request Forgery (CSRF) | Secur0 |
Affected Products
| Product | Versions |
|---|---|
| Roskus Prospero Flow CRM | < 5.15.11 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 4, 2026 | CVE Modified | CISA-ADP |
| Sep 4, 2026 | New CVE Received | Secur0 |