How AI contributed: Incomplete remediationPublished Aug 10, 2026 in 
roskus/prospero-flow-crmAll 3 findings in this repository
Missing Authorization in the permission management component in Roskus Prospero Flow CRM before 5.2.1 allows any authenticated user to grant any role, including their own, the complete set of application permissions via a crafted POST request to the permission save endpoint, which performs no authorization check before synchronizing the submitted permissions to the specified role.
Moved PermissionSaveController under MainController authentication.
Case facts
ClaudeOnly the highlighted steps are this advisory. The first step is the earlier flaw the AI tried, and failed, to close.
Original flaw
Earlier flawSink: Prospero PermissionSaveController POST /permission Role::findById(...)->syncPermissions(...) sink
Originally written by Antonio
This advisoryCVE-2026-59233 (GHSA-4FXP-2M36-QV64)
AI tried to fix this
The AI-assisted change was a real security patch, but it left the same advisory reachable.
Missed: Added no authorization check for the submitted target role and permissions.
Incomplete AI-assisted fix · Claude
Fixed again
This is the patch that actually stops the same attack path.
AI-assisted fix: Claude Code · Gustavo Novaro
diff --git a/app/Http/Controllers/Permission/PermissionSaveController.php b/app/Http/Controllers/Permission/PermissionSaveController.phpindex a558cb646..f0da620c7 100755--- a/app/Http/Controllers/Permission/PermissionSaveController.php+++ b/app/Http/Controllers/Permission/PermissionSaveController.php@@ -4,12 +4,12 @@ namespace App\Http\Controllers\Permission; -use App\Http\Controllers\Controller;+use App\Http\Controllers\MainController; use Illuminate\Http\RedirectResponse; use Illuminate\Http\Request; use Spatie\Permission\Models\Role; -class PermissionSaveController extends Controller+class PermissionSaveController extends MainController { public function save(Request $request): RedirectResponse {diff --git a/app/Http/Controllers/Permission/PermissionSaveController.php b/app/Http/Controllers/Permission/PermissionSaveController.phpindex f0da620c7..afb716d4e 100755--- a/app/Http/Controllers/Permission/PermissionSaveController.php+++ b/app/Http/Controllers/Permission/PermissionSaveController.php@@ -7,0 +8 @@+use App\Http\Requests\PermissionSaveRequest;@@ -9 +9,0 @@-use Illuminate\Http\Request;@@ -14 +14 @@ class PermissionSaveController extends MainController- public function save(Request $request): RedirectResponse+ public function save(PermissionSaveRequest $request): RedirectResponse@@ -16,4 +16,5 @@ public function save(Request $request): RedirectResponse- $roles = $request->roles;-- foreach ($roles as $role_id => $permissions) {- Role::findById($role_id)->syncPermissions($permissions);+ foreach ($request->validated()['roles'] as $role_id => $permissions) {+ $role = Role::find($role_id);+ if ($role) {+ $role->syncPermissions($permissions);+ }@@ -22 +23 @@ public function save(Request $request): RedirectResponse- return redirect('/permission');+ return redirect('/permission')->with('success', __('Permissions updated successfully'));diff --git a/app/Http/Requests/PermissionSaveRequest.php b/app/Http/Requests/PermissionSaveRequest.phpnew file mode 100644index 000000000..3107cf835--- /dev/null+++ b/app/Http/Requests/PermissionSaveRequest.php@@ -0,0 +1,37 @@+<?php++declare(strict_types=1);++namespace App\Http\Requests;++use Illuminate\Foundation\Http\FormRequest;+use Illuminate\Support\Facades\Auth;+use Spatie\Permission\Models\Permission;+use Spatie\Permission\Models\Role;++class PermissionSaveRequest extends FormRequest+{+ public function authorize(): bool+ {+ return Auth::user()?->hasRole('SuperAdmin') ?? false;+ }++ public function rules(): array+ {+ return [+ 'roles' => 'required|array',+ 'roles.*' => 'required|array',+ 'roles.*.*' => 'required|string|exists:permission,name',+ ];+ }++ public function prepareForValidation(): void+ {+ $roles = $this->input('roles', []);+ foreach ($roles as $role_id => $permissions) {+ if (! Role::where('id', $role_id)->exists()) {+ $this->merge(['invalid_role' => $role_id]);+ }+ }+ }+}AI-assisted change 1d391d40ad2735f0feb2aa53e96c31ed12dbce5dfdf2556ce90c45192100d1f7 · Fix 1b826c2cf84307f7c1b34cc340b350ed9578f7cfe374f631ef91e3515d9b7830