CVE-2026-82911: Prospero Flow CRM CSRF Vulnerability

CVE-2026-82911 Overview

CVE-2026-82911 is a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] in Roskus Prospero Flow CRM versions before 5.15.11. The flaw resides in the OrderConfirmController exposed at GET /order/confirm/{order_number}. Laravel's VerifyCsrfToken middleware enforces CSRF tokens only on POST, PUT, PATCH, and DELETE requests, so the Route::get declaration leaves this state-changing action unprotected. An unauthenticated attacker can direct a signed-in user to a crafted page and confirm any order on their behalf. Because order numbers are sequential integers, an attacker can enumerate and confirm every existing order in a single automated sweep.

Critical Impact
A single link click by an authenticated user can transition any target order from pending to confirmed without authorization, and sequential order numbers enable full enumeration.

Affected Products

Roskus Prospero Flow CRM versions prior to 5.15.11
Deployments using the vulnerable OrderConfirmController::confirm() route
Laravel applications relying on default VerifyCsrfToken middleware behavior for GET routes

Discovery Timeline

2026-09-04 - CVE-2026-82911 published to the National Vulnerability Database (NVD)
2026-09-09 - Last updated in the NVD database

Technical Details for CVE-2026-82911

Vulnerability Analysis

The vulnerability stems from a state-changing action being exposed through an HTTP GET verb. The route definition Route::get('/order/confirm/{order_number}', [OrderConfirmController::class, 'confirm']) accepts idempotent-looking GET requests, yet the handler mutates server state by transitioning an order's status from pending to confirmed. Laravel's built-in CSRF middleware inspects only unsafe verbs (POST, PUT, PATCH, DELETE), so no anti-forgery token is validated for this endpoint. Session cookies configured with SameSite=Lax are automatically attached to top-level cross-site navigations, which means a simple <a href>, <img src>, or window.location assignment on an attacker-controlled page fires the request under the victim's session.

Root Cause

The root cause is a misalignment between HTTP semantics and application behavior. Per RFC 9110, GET requests must be safe and side-effect free. Prospero Flow CRM violated this by binding a mutating operation to GET, then relying on framework defaults that only guard unsafe methods. The ->can('update order') gate authorizes the action but does nothing to prove intent, so any authenticated user with that permission becomes a viable CSRF target.

Attack Vector

Exploitation requires no attacker credentials. The attacker hosts a page containing a reference to https://victim-crm.example/order/confirm/{n}. When a logged-in user with the update order permission visits or previews the page, their browser issues the request with session cookies attached and the order is confirmed. Because {order_number} is a sequential integer, an attacker can embed many URLs on one page and confirm every order in the system during a single visit.

The upstream fix converts the endpoint to POST and requires a CSRF token. The route change from the commit is shown below:

php

// Before (vulnerable)
Route::get('/order/confirm/{order_number}', [OrderConfirmController::class, 'confirm'])->can('update order');

// After (patched)
Route::post('/order/confirm/{order_number}', [OrderConfirmController::class, 'confirm'])
    ->name('order.confirm')
    ->can('update order');

Source: Roskus prospero-flow-crm commit a90c0c8c

Detection Methods for CVE-2026-82911

Indicators of Compromise

Web server access logs containing GET /order/confirm/{order_number} entries where the HTTP Referer header points to an external or unexpected origin.
Bursts of sequential GET /order/confirm/1, /order/confirm/2, /order/confirm/3 requests originating from a single authenticated session within a short window.
Order status transitions from pending to confirmed that lack a corresponding user-initiated form submission in application audit logs.

Detection Strategies

Alert on any HTTP GET request to /order/confirm/* after the patch is deployed, since legitimate traffic should only use POST.
Correlate order confirmation events with the presence of a valid CSRF token in the associated request and flag confirmations without one.
Monitor for anomalous Referer or Origin header values on order state-change endpoints and compare against an allowlist of internal application URLs.

Monitoring Recommendations

Enable verbose web application firewall (WAF) logging for all routes matching /order/confirm/* and retain logs for retrospective hunting.
Instrument the OrderConfirmController::confirm() handler to emit structured audit events including user ID, order number, request method, and originating IP.
Review historical logs for evidence of pre-patch exploitation, focusing on rapid sequential confirmations tied to a single session.

How to Mitigate CVE-2026-82911

Immediate Actions Required

Upgrade Roskus Prospero Flow CRM to version 5.15.11 or later, which converts the confirmation endpoint to POST with CSRF token enforcement.
Audit order records for unauthorized status transitions from pending to confirmed since the vulnerable route was deployed.
Rotate active user sessions after patching to invalidate any tokens that may have been referenced from attacker-controlled pages.

Patch Information

The upstream fix is delivered in commit a90c0c8c. It changes the route in routes/module/order.php from Route::get to Route::post, assigns the named route order.confirm, and updates resources/views/order/index.blade.php to submit through a <form method="POST"> that includes the @csrf directive and a JavaScript confirmation prompt. See the Roskus prospero-flow-crm commit a90c0c8c and the Secur0 CVE-2026-82911 analysis for the full patch details.

Workarounds

If immediate patching is not possible, block or rewrite inbound GET /order/confirm/* requests at a reverse proxy or WAF and require POST with a validated CSRF token.
Configure application session cookies with SameSite=Strict to prevent cookies from being sent on cross-site top-level navigations to the confirmation endpoint.
Add a server-side check that rejects requests to OrderConfirmController::confirm() whose Origin or Referer header does not match the application's own domain.

bash

# Example nginx rule to block the vulnerable GET route until patched
location ~ ^/order/confirm/ {
    if ($request_method = GET) {
        return 405;
    }
    proxy_pass http://prospero_flow_backend;
}