Is CVE-2026-82911 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-82911 being exploited in the wild.

How severe is CVE-2026-82911?

Informational severity, with a CVSS score of 5.1, published 4 September 2026.

Which products and versions are affected?

Roskus Prospero Flow CRM before 5.15.11.

Is there a fix for CVE-2026-82911?

A patch was published on 2026-09-04: Fix committed to main branch as a90c0c8c; version 5.15.11 not yet tagged or released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-82911 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-82911?

Check whether you run Roskus Prospero Flow CRM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-82911: Roskus Prospero Flow CRM cross-site request forgery in order confirmation

CVE-2026-82911 · Severity: info · CVSS 5.1 · Published 2026-09-04

Prospero Flow CRM is a customer relationship management platform used to manage sales orders and workflows. A design flaw in the order confirmation feature allows attackers to fraudulently confirm customer orders by tricking authenticated users into clicking a malicious link, causing unauthorized state changes to orders without the customer's knowledge or consent. Since order numbers are predictable, attackers can confirm all orders on the system in an automated attack.

Technologies: Roskus Prospero Flow CRM. Vendors: Roskus.

Quick answers

Is CVE-2026-82911 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-82911 being exploited in the wild.
How severe is CVE-2026-82911?: Informational severity, with a CVSS score of 5.1, published 4 September 2026.
Which products and versions are affected?: Roskus Prospero Flow CRM before 5.15.11.
Is there a fix for CVE-2026-82911?: A patch was published on 2026-09-04: Fix committed to main branch as a90c0c8c; version 5.15.11 not yet tagged or released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-82911 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-82911?: Check whether you run Roskus Prospero Flow CRM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is a Cross-Site Request Forgery (CSRF) vulnerability in the OrderConfirmController::confirm() endpoint, exposed at GET /order/confirm/{order_number}. The root cause is that the order confirmation route uses the HTTP GET method, which is not protected by Laravel's VerifyCsrfToken middleware (which only guards POST, PUT, PATCH, and DELETE requests). When an authenticated user visits an attacker-controlled page containing a link to this endpoint, their browser automatically includes session cookies with SameSite=Lax settings, allowing the attacker to trigger order state changes from pending to confirmed. Because order numbers are sequential integers, an attacker can enumerate and confirm all existing orders in an automated sweep. The vulnerability affects all versions before 5.15.11; the fix changes the route from GET to POST and adds CSRF token validation via the @csrf directive in the order confirmation form.

Affected products

Roskus Prospero Flow CRM before 5.15.11

Timeline

2026-09-04: disclosed
2026-09-04: patched: Fix committed to main branch as a90c0c8c; version 5.15.11 not yet tagged or released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.