What’s Vulnerable › Vulnerabilities

CVE-2026-59234: Authorization Bypass Through User-Controlled Key in Prospero Flow CRM calendar event deletion

• Severity: medium (CVSS 6.9 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-07-03 · updated 2026-10-25
• Weakness: CWE-639

Description

Authorization Bypass Through User-Controlled Key (CWE-639) in CalendarDeleteEventController (app/Http/Controllers/Calendar/CalendarDeleteEventController.php), exposed at GET /calendar/event/delete/{id}, in Prospero Flow CRM before 5.5.3 allows a remote, authenticated attacker to delete arbitrary calendar events belonging to other users by manipulating the {id} path parameter, because the delete handler resolves the record with Calendar::find($id)->delete() and performs no ownership check (no user_id/company_id scoping) before deletion. This results in unauthorized destruction of other users' calendar events across the platform.

Affected products

• Roskus Prospero Flow CRM: from 1.0.0 before 5.5.3 — fixed in 5.5.3

How to fix

Upgrade to a fixed version: Roskus Prospero Flow CRM 5.5.3. Check the vendor advisory for mitigations.

References

• https://github.com/Roskus/prospero-flow-crm/commit/8c26eed4d80544c30e55448e12a8e999af6d2b70
• https://github.com/Roskus/prospero-flow-crm/releases/tag/v5.5.3
• https://secur0.com/en/cna/cve-list/cve-2026-59234-idor-in-prospero-flow-crm-allows-deletion-of-other-users-calendar-events

Get alerted when CVE-2026-59234 or the next vulnerability affects your stack