CVE-2026-59239

Name of the Vulnerable Software and Affected Versions Roskus Prospero Flow CRM versions prior to 5.4.4

Description The email module contains a stored cross-site scripting issue. A remote, authenticated user with low privileges can execute arbitrary JavaScript in the browser of another user, including administrators, by storing a malicious payload in an email body. This occurs because the email body is persisted without sanitization and rendered unescaped using {!! $email->body !!} when the recipient opens the message, which can lead to session compromise and account takeover.

Recommendations Update Roskus Prospero Flow CRM to version 5.4.4 or later.