Is CVE-2026-59239 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-59239 being exploited in the wild.

How severe is CVE-2026-59239?

Informational severity, with a CVSS score of 8.6, published 27 July 2026.

Which products and versions are affected?

Roskus Prospero Flow CRM 1.0.0 to 5.4.3.

Is there a fix for CVE-2026-59239?

A patch was published on 2026-06-26: Security release v5.5.3 published (includes fix for 5.4.4) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-59239 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-59239?

Check whether you run Roskus Prospero Flow CRM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-59239: Roskus Prospero Flow CRM stored XSS in email module and user signature

CVE-2026-59239 · Severity: info · CVSS 8.6 · Published 2026-07-27

Roskus Prospero Flow CRM, a customer relationship management platform, contains a security flaw in its email and user profile modules. An attacker can send a specially crafted email or update a profile signature to execute malicious code in the browser of another user, such as an administrator, who views the content. This could allow the attacker to steal session information, take over user accounts, and gain unauthorized access to sensitive customer data.

Technologies: Roskus Prospero Flow CRM. Vendors: Roskus.

Quick answers

Is CVE-2026-59239 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-59239 being exploited in the wild.
How severe is CVE-2026-59239?: Informational severity, with a CVSS score of 8.6, published 27 July 2026.
Which products and versions are affected?: Roskus Prospero Flow CRM 1.0.0 to 5.4.3.
Is there a fix for CVE-2026-59239?: A patch was published on 2026-06-26: Security release v5.5.3 published (includes fix for 5.4.4) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-59239 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-59239?: Check whether you run Roskus Prospero Flow CRM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A stored Cross-Site Scripting (XSS) vulnerability exists in the email module and user profile signature functionality of Roskus Prospero Flow CRM. The root cause is the lack of input sanitization in 'EmailCreateService.php' and 'ProfileSaveController.php', combined with unescaped output rendering in 'view.blade.php' using the '{!! $email->body !!}' syntax. An authenticated attacker can inject malicious payloads into an email body or their own profile signature. When a victim (including administrators) views the affected email or profile, the payload executes in their browser context, potentially leading to session hijacking and full account takeover. The issue is resolved in version 5.4.4 by implementing input sanitization and removing dangerous event handlers.

Affected products

Roskus Prospero Flow CRM 1.0.0 to 5.4.3

Timeline

2026-06-26: patched: Security release v5.5.3 published (includes fix for 5.4.4)
2026-07-27: advisory: CVE published by Secur0 CNA

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.