CVE-2026-82911

Name of the Vulnerable Software and Affected Versions Roskus Prospero Flow CRM versions prior to 5.15.11

Description Cross-Site Request Forgery (CSRF) occurs in the OrderConfirmController at the 'GET /order/confirm/{order number}' endpoint. This issue arises because the Route::get declaration allows state-changing actions to bypass the VerifyCsrfToken middleware, which only enforces tokens on POST, PUT, PATCH, and DELETE requests. Since session cookies with SameSite=Lax are included in top-level cross-site navigation, an unauthenticated attacker can trick an authenticated user into clicking a crafted link to trigger the confirm() function. This transitions orders from pending to confirmed without authorization. Additionally, because the order number variable uses sequential integers, an attacker can enumerate and confirm all existing orders.

Recommendations Update Roskus Prospero Flow CRM to version 5.15.11 or later. As a temporary workaround, restrict access to the 'GET /order/confirm/{order number}' endpoint to minimize the risk of exploitation.