CVE-2026-82911

    Dashboard / Vulnerabilities / CVE-2026-82911

    CVE-2026-82911

    Published: 4 Sept 2026Last Modified: 11 Sept 2026

    Summary: CSRF in Prospero Flow CRM order confirmation allows unauthorized order state changes

    Details: Cross-Site Request Forgery (CSRF) in the OrderConfirmController at GET /order/confirm/{order_number} in Roskus Prospero Flow CRM before 5.15.11 allows an unauthenticated attacker to confirm any order on behalf of an authenticated user by directing them to a crafted page. Laravel's VerifyCsrfToken middleware enforces CSRF tokens only on POST, PUT, PATCH, and DELETE requests; the Route::get declaration leaves this state-changing action unprotected. Session cookies configured with SameSite=Lax are automatically included in top-level cross-site navigation, so a single link click triggers OrderConfirmController::confirm() and transitions the target order from pending to confirmed without user authorization. Because order numbers are sequential integers, an attacker can enumerate and confirm all existing orders in a single automated sweep.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/82xxx/CVE-2026-82911.json, https://nvd.nist.gov/vuln/detail/CVE-2026-82911, https://secur0.com/en/cna/cve-list/cve-2026-82911-csrf-order-confirmation-prospero-flow-crm, https://github.com/Roskus/prospero-flow-crm/commit/a90c0c8c, https://github.com/Roskus/prospero-flow-crm

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -a90c0c8c

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-82911 | CVE-DB