This vulnerability is a stored cross-site scripting (CWE-79) issue in Roskus Prospero Flow CRM's email module prior to version 5.4.4. The flaw arises because the email body content is rendered using an unescaped output method ({!! $email->body !!}), allowing malicious JavaScript payloads stored in emails to execute in the context of other users' browsers. Exploitation requires a remote attacker with low-privileged authenticated access to inject the payload into an email body. When the recipient opens the email, the malicious script executes, potentially compromising sessions and enabling account takeover.

An attacker with low-privileged authenticated access can inject malicious scripts into email bodies that execute in the browsers of other users, including administrators. This can lead to session hijacking and account takeover, posing a significant risk to the confidentiality and integrity of user accounts within the CRM.

No official patch or remediation is currently confirmed. Users should monitor the vendor's advisory for updates and apply any official fixes once available. Until then, restrict low-privileged user access to email functionalities if possible and consider manual sanitization or filtering of email content as a temporary measure.