A Cross‑Site Request Forgery flaw in the Prospero Flow CRM OrderConfirmController allows an attacker who does not need to authenticate to confirm any order on behalf of an authenticated user by simply visiting a crafted page. The vulnerability arises because Laravel’s CSRF middleware protects only POST, PUT, PATCH, and DELETE verbs, leaving the GET route that changes order state unguarded. Session cookies set with SameSite=Lax are sent automatically during regular cross‑site navigation, enabling a single link click to trigger the confirmation action and move an order from pending to confirmed without user knowledge. Since order numbers are sequential, an attacker can enumerate and confirm every existing order in a single automated sweep.

The flaw affects Roskus Prospero Flow CRM versions earlier than 5.15.11. Upgrading to 5.15.11 or later from the main branch applies the fix; no earlier tagged release contains the patch.

The CVSS score of 5.1 classifies the vulnerability as medium severity, and the EPSS and KEV information are unavailable or negative, indicating no known widespread exploitation. Nevertheless, the attack requires that a user visits a malicious or maliciously modified page to trigger the GET request, making phishing or social engineering plausible vectors. An attacker could exploit the flaw without needing any additional privileges on the system, and by leveraging sequential order numbers, could potentially compromise all orders in the application.