CVE-2026-59234 Details
Description
Authorization Bypass Through User-Controlled Key (CWE-639) in CalendarDeleteEventController (app/Http/Controllers/Calendar/CalendarDeleteEventController.php), exposed at GET /calendar/event/delete/{id}, in Prospero Flow CRM before 5.5.3 allows a remote, authenticated attacker to delete arbitrary calendar events belonging to other users by manipulating the {id} path parameter, because the delete handler resolves the record with Calendar::find($id)->delete() and performs no ownership check (no user_id/company_id scoping) before deletion. This results in unauthorized destruction of other users' calendar events across the platform.
A vulnerability allowing authorization bypass through user-controlled keys has been identified in the CalendarDeleteEventController of Prospero Flow CRM, affecting versions prior to 5.5.3. This vulnerability allows remote, authenticated attackers to delete arbitrary calendar events belonging to other users. The issue arises because the deletion process does not include ownership checks, allowing attackers to manipulate the event ID in the URL and delete events from other users' calendars.
Users are advised to upgrade to Prospero Flow CRM version 5.5.3 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 3, 2026CISA-ADP
Assessed Jul 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Roskus/prospero-flow-crm/commit/8c26eed4d80544c30e55448e12a8e999af6d2b70 | Secur0 | Source CodeVendor |
| https://github.com/Roskus/prospero-flow-crm/releases/tag/v5.5.3 | Secur0 | Release NotesVendor |
| https://secur0.com/en/cna/cve-list/cve-2026-59234-idor-in-prospero-flow-crm-allows-deletion-of-other-users-calendar-events | Secur0 | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | Secur0 |
Affected Products
| Product | Versions |
|---|---|
| Prospero Flow CRM | < 5.5.3 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 6, 2026 | CVE Modified | CISA-ADP |
| Jul 3, 2026 | New CVE Received | Secur0 |