Executive brief
Roskus Prospero Flow CRM, a customer relationship management platform, contains a security flaw in its email and user profile modules. An attacker can send a specially crafted email or update a profile signature to execute malicious code in the browser of another user, such as an administrator, who views the content. This could allow the attacker to steal session information, take over user accounts, and gain unauthorized access to sensitive customer data.
Technical details
A stored Cross-Site Scripting (XSS) vulnerability exists in the email module and user profile signature functionality of Roskus Prospero Flow CRM. The root cause is the lack of input sanitization in 'EmailCreateService.php' and 'ProfileSaveController.php', combined with unescaped output rendering in 'view.blade.php' using the '{!! $email->body !!}' syntax. An authenticated attacker can inject malicious payloads into an email body or their own profile signature. When a victim (including administrators) views the affected email or profile, the payload executes in their browser context, potentially leading to session hijacking and full account takeover. The issue is resolved in version 5.4.4 by implementing input sanitization and removing dangerous event handlers.
Affected products
- Roskus Prospero Flow CRM 1.0.0 to 5.4.3
Timeline
- 2026-06-26: patched: Security release v5.5.3 published (includes fix for 5.4.4)
- 2026-07-27: advisory: CVE published by Secur0 CNA