The vulnerability arises from missing authorization checks in the permission management component of Roskus Prospero Flow CRM before version 5.2.1. Specifically, the permission save endpoint accepts POST requests to synchronize permissions to roles without verifying if the requesting user is authorized to make such changes. As a result, an authenticated user can escalate privileges by assigning any role the complete set of application permissions, effectively bypassing intended access controls. This issue is tracked as CWE-639 (Authorization Bypass Through User-Controlled Key).

An authenticated user can escalate their privileges arbitrarily by assigning any role, including their own, full application permissions. This could lead to unauthorized access to sensitive functions and data within the CRM application, potentially compromising the confidentiality, integrity, and availability of the system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the permission management functionality to trusted administrators only and monitor for suspicious permission changes.