The vulnerability arises from a lack of authorization verification in the permission save endpoint of Roskus Prospero Flow CRM before version 5.2.1. Authenticated users can exploit this by submitting a specially crafted POST request that modifies the permissions of any role without restriction. This results in unauthorized privilege escalation, as users can assign themselves or others the complete set of application permissions. The issue is classified under CWE-639 (Authorization Bypass Through User-Controlled Key).

Exploitation of this vulnerability allows any authenticated user to gain full application permissions by modifying roles arbitrarily. This can lead to unauthorized access to sensitive functions and data within the CRM, potentially compromising the confidentiality, integrity, and availability of the system. The CVSS 4.0 base score is 8.7, indicating a high impact with network attack vector, low attack complexity, no user interaction required, and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch link is provided, users should monitor Roskus advisories for updates. Until a patch is available, restrict authenticated user permissions to the minimum necessary and consider additional access controls or monitoring to detect unauthorized permission changes.