Cross-Site Request Forgery (CSRF) in the OrderConfirmController at GET /order/confirm/{order_number} in Roskus Prospero Flow CRM before 5.15.11… (CVE-2026-82911)

The vulnerability is a CSRF in Roskus Prospero Flow CRM before version 5.15.11 affecting the OrderConfirmController's GET /order/confirm/{order_number} endpoint. Laravel's VerifyCsrfToken middleware protects only POST, PUT, PATCH, and DELETE requests, leaving this GET request unprotected despite it performing a state-changing action (order confirmation). Because session cookies configured with SameSite=Lax are included in top-level cross-site navigations, an attacker can craft a link that, when visited by an authenticated user, triggers order confirmation without authorization. The use of sequential integers for order numbers allows automated enumeration and mass confirmation of orders by attackers.

An attacker can cause authenticated users to unknowingly confirm orders by directing them to maliciously crafted URLs. This can lead to unauthorized order confirmations without user consent. The vulnerability affects the integrity of order processing in the CRM system. There is no indication of direct data disclosure or privilege escalation, but the unauthorized state change can disrupt business operations and order management.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, it is recommended to avoid exposing state-changing actions via GET requests. Implement CSRF protection on all state-changing endpoints, including GET if necessary, or change the order confirmation action to use POST or another method protected by CSRF tokens. Additionally, consider configuring session cookies with stricter SameSite policies (e.g., SameSite=Strict) to reduce risk of CSRF via cross-site navigation.