K1Di3

**Name of the Vulnerable Software and Affected Versions** Roskus Prospero Flow CRM versions prior to 5.2.1 **Description** The permission management component contains a flaw where the permission save endpoint does not perform authorization checks. This allows any authenticated user to grant any role, including their own, the full set of application permissions by sending a crafted POST request to the endpoint, which then synchronizes the submitted permissions to the specified role. **Recommendations** Update to version 5.2.1 or later.

**Name of the Vulnerable Software and Affected Versions** Roskus Prospero Flow CRM versions prior to 5.3.7 **Description** Authenticated users with permissions to create or update leads can execute arbitrary JavaScript within the application origin. This occurs in the lead index view when HTML markup stored in the lead name field is rendered using Blade's unescaped output directive and placed inside a JavaScript string literal within an `onclick` attribute. **Recommendations** Update Roskus Prospero Flow CRM to version 5.3.7 or later.