CVE-2026-59239: Prospero Flow CRM XSS Vulnerability

CVE-2026-59239 Overview

CVE-2026-59239 is a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in the email module of Roskus Prospero Flow CRM before version 5.4.4. A remote, authenticated low-privileged user can inject arbitrary JavaScript into an email body. The payload is persisted without sanitization and later rendered unescaped using the Laravel Blade directive {!! $email->body !!} when a recipient opens the message. When an administrator views the crafted email, the attacker's script executes in the administrator's session, enabling session compromise and account takeover.

Critical Impact
A low-privileged authenticated user can achieve administrator account takeover by sending a single crafted email containing a stored JavaScript payload.

Affected Products

Roskus Prospero Flow CRM versions prior to 5.4.4
The vulnerable email module rendering {!! $email->body !!} in Blade templates
User profile signature field (signature_html) in the same codebase

Discovery Timeline

2026-07-27 - CVE-2026-59239 published to NVD
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-59239

Vulnerability Analysis

The vulnerability resides in the Prospero Flow CRM email module, which stores user-supplied email content directly in the database without sanitization. When any recipient opens the message, the Blade template renders the body using the raw output directive {!! $email->body !!}. This bypasses Laravel's default HTML escaping, allowing embedded <script> tags and event handlers to execute in the recipient's browser context.

Because the email module accepts input from any authenticated user regardless of role, a low-privileged account can target higher-privileged users such as administrators. Successful exploitation runs arbitrary JavaScript under the victim's origin, enabling session cookie theft, CSRF-style API calls, and full account takeover. The same class of flaw affects the signature_html field on user profiles, which was also stored unsanitized.

Root Cause

The root cause is the use of Laravel's unescaped output syntax {!! ... !!} on untrusted, persisted user input combined with missing server-side input sanitization at the EmailRequest validation layer. The application trusted email body content as safe HTML, so no strip_tags, allow-listing, or output encoding was applied before rendering.

Attack Vector

An authenticated attacker composes an email through the CRM interface and embeds a JavaScript payload in the body field. The message is stored verbatim. When an administrator opens the email, the browser parses and executes the payload in the authenticated administrator session. User interaction (opening the email) is required, but no additional privileges or user gestures beyond normal message viewing are needed.

php

// Patch: app/Http/Controllers/Profile/ProfileSaveController.php
         $user->lang = $locale;
         $user->phone = $request->phone;
         $user->timezone = $request->timezone;
-        $user->signature_html = $request->signature_html;
+        $user->signature_html = ! empty($request->signature_html)
+            ? strip_tags($request->signature_html, '<a><b><strong><i><em><u><br><p><div><span><ul><ol><li><img>')
+            : null;

         // Update password if change
         if (! empty($request->password) && ! empty($request->password_confirmation) && ($request->password == $request->password_confirmation)) {

Source: Roskus Prospero Flow CRM Security Commit

The patch introduces an allow-list of safe HTML tags via strip_tags for the profile signature, removing script-executing constructs before persistence.

php

// Patch: app/Http/Requests/EmailRequest.php
 namespace App\Http\Requests;

+use App\Http\Requests\Concerns\SanitizesInput;
 use Illuminate\Foundation\Http\FormRequest;
 use Illuminate\Support\Facades\Auth;

 class EmailRequest extends FormRequest
 {
+    use SanitizesInput;
+
     public function authorize()
     {
         return Auth::check();
     }

+    protected function unsafeFields(): array
+    {
+        return ['body'];
+    }
+
     public function rules()
     {
         return [

Source: Roskus Prospero Flow CRM Security Commit

The EmailRequest form request now uses the SanitizesInput trait and declares body as an unsafe field requiring sanitization before it reaches persistence or rendering.

Detection Methods for CVE-2026-59239

Indicators of Compromise

Email records in the CRM database whose body column contains <script, onerror=, onload=, javascript:, or <iframe substrings.
User profile rows where signature_html contains executable HTML constructs beyond the post-patch allow-list.
Unexpected outbound HTTP requests from administrator browser sessions to attacker-controlled hosts shortly after opening a CRM email.
New or modified administrator accounts, API tokens, or password resets originating from a session that recently viewed a suspicious email.

Detection Strategies

Run a SQL audit against the emails table searching for HTML tags, event handlers, and encoded JavaScript payloads in the body field.
Review web server access logs for CRM email-view routes followed by anomalous state-changing requests from the same session cookie.
Correlate low-privileged user email sends with subsequent administrator activity to identify potential attacker-to-victim pivot patterns.

Monitoring Recommendations

Enable Content Security Policy (CSP) reporting to capture inline script violations originating from CRM email views.
Log and alert on administrator session activity that deviates from baseline, such as bulk user creation or role changes following an email read event.
Retain CRM application logs and database write audit trails covering the exposure window prior to upgrading to 5.4.4.

How to Mitigate CVE-2026-59239

Immediate Actions Required

Upgrade Roskus Prospero Flow CRM to version 5.4.4 or later, which introduces sanitization for the email body and signature_html fields.
Rotate administrator session tokens, API keys, and passwords for any account that opened attacker-supplied emails during the exposure window.
Audit stored email bodies and user signatures for embedded scripts and purge or neutralize malicious content prior to upgrade.
Restrict email module access to trusted roles until the patch is applied.

Patch Information

The fix is available in the upstream commit 32efcd5c395ee55119fb9aea502a9d06e4c5adb8, which introduces the SanitizesInput trait, marks the email body as an unsafe field, and applies strip_tags with an allow-list to signature_html. See the GitHub commit and the Prospero Flow CRM releases page for versioned artifacts. Additional analysis is available in the Secur0 CVE-2026-59239 write-up.

Workarounds

Replace the Blade directive {!! $email->body !!} with the escaped form {{ $email->body }} in email view templates until the official patch is deployed.
Deploy a strict Content Security Policy that disallows inline scripts and untrusted script sources for CRM pages.
Front the CRM with a web application firewall rule that blocks HTML tags and event-handler attributes submitted to the email body endpoint.

bash

# Verify upgraded version and confirm sanitization trait is present
grep -R "SanitizesInput" app/Http/Requests/EmailRequest.php
grep -R "{!! \$email->body !!}" resources/views/ && echo "Unsafe Blade directive still present"
composer show roskus/prospero-flow-crm | grep versions