CVE-2026-82911 in Prospero Flow CRM
Summary
by MITRE • 09/04/2026
Cross-Site Request Forgery (CSRF) in the OrderConfirmController at GET /order/confirm/{order_number} in Roskus Prospero Flow CRM before 5.15.11 allows an unauthenticated attacker to confirm any order on behalf of an authenticated user by directing them to a crafted page. Laravel's VerifyCsrfToken middleware enforces CSRF tokens only on POST, PUT, PATCH, and DELETE requests; the Route::get declaration leaves this state-changing action unprotected. Session cookies configured with SameSite=Lax are automatically included in top-level cross-site navigation, so a single link click triggers OrderConfirmController::confirm() and transitions the target order from pending to confirmed without user authorization. Because order numbers are sequential integers, an attacker can enumerate and confirm all existing orders in a single automated sweep.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/04/2026
The vulnerability identified as Cross-Site Request Forgery (CSRF) within Roskus Prospero Flow CRM prior to version 5.15.11 represents a critical failure in access control mechanisms, specifically affecting the OrderConfirmController endpoint located at GET /order/confirm/{order_number}. This flaw allows an unauthenticated attacker to execute state-changing actions on behalf of authenticated users without their knowledge or consent. The core technical issue stems from the misconfiguration of Laravel's VerifyCsrfToken middleware, which is designed to protect against CSRF attacks by requiring valid anti-CSRF tokens for requests that modify server-side data. However, in this specific implementation, the middleware enforces these token checks exclusively on POST, PUT, PATCH, and DELETE HTTP methods. Consequently, any action defined via a Route::get declaration remains unprotected because GET requests are not subject to strict CSRF validation by default in many standard configurations, under the assumption that they should be safe and idempotent.
The operational impact of this vulnerability is severe due to the nature of the affected endpoint. The OrderConfirmController::confirm() method transitions an order from a pending state to a confirmed state, which typically triggers downstream processes such as inventory deduction, payment processing initiation, or shipping logistics. Because the application relies on session cookies configured with SameSite=Lax for authentication, these cookies are automatically included in top-level cross-site navigations. This means that if an authenticated user clicks a link hosted on a malicious domain directing them to the crafted URL containing the target order number, their browser will send their valid session cookie along with the request. The server interprets this as a legitimate action from the authenticated user, thereby confirming the order without any additional authorization checks or user interaction beyond the initial click.
A significant aggravating factor in this vulnerability is the predictability of the input parameter, specifically the order number. Since order numbers are implemented as sequential integers, an attacker can easily enumerate valid order identifiers by iterating through a range of integer values. This allows for automated sweeping attacks where a single malicious page or script can attempt to confirm multiple orders simultaneously. An attacker could potentially disrupt business operations by confirming large volumes of pending orders, leading to inventory discrepancies, financial losses if payments are processed prematurely, and significant customer service issues due to unfulfilled expectations or incorrect order statuses. This enumeration capability transforms what might have been a targeted attack into a scalable denial-of-service or data integrity compromise vector.
From an industry standards perspective, this vulnerability aligns with CWE-352: Cross-Site Request Forgery (CSRF), which describes the inclusion of user credentials in requests initiated by third-party sites without explicit consent. Furthermore, it maps to MITRE ATT&CK technique T1078: Valid Accounts, as the attacker leverages valid session tokens obtained through social engineering or other means to impersonate legitimate users. The failure also reflects CWE-693: Protection Mechanism Failure, specifically in the context of insufficient verification of intent for state-changing operations via safe HTTP methods.
To mitigate this vulnerability, immediate remediation is required by modifying the application's routing and middleware configuration. Developers should ensure that any endpoint capable of changing server-side state, regardless of whether it uses GET or POST, must be protected against CSRF attacks. This can be achieved by explicitly applying the VerifyCsrfToken middleware to the specific route for order confirmation or by rearchitecting the API to use POST requests with JSON payloads and proper token validation for all state-changing operations. Additionally, implementing stricter SameSite cookie attributes such as Strict instead of Lax would prevent session cookies from being sent in cross-site contexts entirely, although this must be balanced against usability requirements. Regular security audits focusing on HTTP method usage and middleware application are essential to prevent similar misconfigurations in future development cycles.