The vulnerability is a stored cross‑site scripting flaw that allows a remote, authenticated low‑privileged user to inject unsanitized JavaScript into an email body. When any recipient—including administrators—opens the poisoned email, the script executes in the victim’s browser context, allowing the attacker to hijack the session and take over the administrator account. This constitutes a severe compromise of confidentiality and integrity for privileged users.

Roskus Prospero Flow CRM before version 5.4.4 is affected. Only the email module’s rendering of the email body using unescaped markup is implicated. The vendor recommends upgrading to version 5.4.4 or later to eliminate the flaw.

The CVSS score of 8.6 indicates high severity, and the EPSS score of 0.00383 (<1%) indicates a very low but non‑zero probability of exploitation, but the flaw remains likely to be exploited in practice because it requires only a low‑privileged authenticated account and relies on a common web vulnerability. The vulnerability is not listed in the CISA KEV catalog, so no active exploit is known, but the attack vector is remote and straightforward: a malicious user can create a crafted email, have an administrator view it, and compromise that account.