---
id: CVE-2026-82911
title: >-
  Cross-Site Request Forgery (CSRF) in the OrderConfirmController at GET
  /order/confirm/{order_number} in Roskus Prospero Flow CRM before 5.15.11
  allows an unauthenticated attacker to confirm any order on behalf of an
  authenticated user by…
summary: >-
  Cross-Site Request Forgery (CSRF) in the OrderConfirmController at GET
  /order/confirm/{order_number} in Roskus Prospero Flow CRM before 5.15.11
  allows an unauthenticated attacker to confirm any order on behalf of an
  authenticated user by…
severity: none
cwe:
  - CWE-352
published: '2026-09-04'
updated: '2026-09-09'
sourceUpdated: '2026-09-09T15:52:04.827'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-82911'
references:
  - url: 'https://github.com/Roskus/prospero-flow-crm/commit/a90c0c8c'
    label: 4daa8cea-433a-44bd-9456-53b127fc289a
  - url: >-
      https://secur0.com/en/cna/cve-list/cve-2026-82911-csrf-order-confirmation-prospero-flow-crm
    label: 4daa8cea-433a-44bd-9456-53b127fc289a
tags:
  - nvd
epss: 0.0023
epssPercentile: 0.12343
ingestedAt: '2026-09-09T16:14:05.518Z'
---

## Overview

Cross-Site Request Forgery (CSRF) in the OrderConfirmController at GET /order/confirm/{order_number} in Roskus Prospero Flow CRM before 5.15.11 allows an unauthenticated attacker to confirm any order on behalf of an authenticated user by directing them to a crafted page. Laravel's VerifyCsrfToken middleware enforces CSRF tokens only on POST, PUT, PATCH, and DELETE requests; the Route::get declaration leaves this state-changing action unprotected. Session cookies configured with SameSite=Lax are automatically included in top-level cross-site navigation, so a single link click triggers OrderConfirmController::confirm() and transitions the target order from pending to confirmed without user authorization. Because order numbers are sequential integers, an attacker can enumerate and confirm all existing orders in a single automated sweep.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.