CyberRota Analysis
AI-GeneratedThe permission management component in Roskus Prospero Flow CRM versions prior to 5.2.1 is vulnerable due to a missing authorization check, allowing any authenticated user to manipulate roles and permissions through a crafted POST request. This could lead to unauthorized access and privilege escalation, potentially compromising sensitive data and application integrity. Organizations using affected versions should prioritize patching to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Missing Authorization in the permission management component in Roskus Prospero Flow CRM before 5.2.1 allows any authenticated user to grant any role, including their own, the complete set of application permissions via a crafted POST request to the permission save endpoint, which performs no authorization check before synchronizing the submitted permissions to the specified role.