CVE-2026-82911: CWE-352 Cross-Site Request Forgery (CSRF) in Roskus Prospero Flow CRM

This vulnerability involves a CSRF attack vector in Roskus Prospero Flow CRM prior to version 5.15.11. The OrderConfirmController exposes a state-changing action via a GET request, which is not protected by Laravel's VerifyCsrfToken middleware since it only protects POST, PUT, PATCH, and DELETE methods. Because session cookies with SameSite=Lax are sent with top-level cross-site navigation, an attacker can cause an authenticated user to confirm orders by directing them to a malicious link. The sequential nature of order numbers allows automated enumeration and confirmation of all orders without user consent or authentication.

An attacker can confirm any order on behalf of an authenticated user without their consent by exploiting the CSRF vulnerability. This can lead to unauthorized order confirmations, potentially disrupting order processing and business operations. The vulnerability does not require privileges or user interaction beyond clicking a link, increasing the risk of exploitation. However, there is no indication of further privilege escalation or data disclosure from this vulnerability alone.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid exposing state-changing actions via GET requests and consider implementing additional CSRF protections on such endpoints. Reviewing route definitions to use POST or other protected methods for state changes and enforcing CSRF tokens on all sensitive actions is recommended.