CVE-2026-59234
MediumCVSS 6.9Exploitation Probability (EPSS)
Low risk32th percentile - higher than 32% of all known CVEs
Summary
A vulnerability in Prospero Flow CRM before version 5.5.3 allows an authenticated attacker to delete arbitrary calendar events of other users by manipulating the {id} parameter in a GET request to /calendar/event/delete/{id}. The lack of ownership check (user_id/company_id) before deletion leads to unauthorized data destruction.
Risk Assessment
The organization is at risk of losing other users' calendar data, which can disrupt team operations and compromise the confidentiality of meeting information.
Recommendation
Immediately update Prospero Flow CRM to version 5.5.3 or later, which includes a fix for this vulnerability.
Other vulnerabilities in Prospero Flow CRM
See all- CVE-2026-77780Medium
Roskus Prospero Flow CRM versions 4.9.1 through 5.14.0 have an authorization bypass vulnerability via user-controlled key in the transaction save endpoint. A user with transaction creation permissions can disclose another company's bank account name, bank name, and card last four digits by providing a foreign `bank_account_id` or `bank_card_id` in POST /transaction/save.
- CVE-2026-77759High
Roskus Prospero Flow CRM versions 5.0.0 through 5.3.5 have an authorization bypass through user-controlled key in the transaction API. An authenticated user can read transactions of other companies on the same instance via an incremented identifier in GET /api/transaction/{id}, without company scoping or permission check.
- CVE-2026-59237Medium
The vulnerability allows an authenticated user to bypass authorization by manipulating numeric IDs in REST API endpoints. The Order and OrderItem controllers in Prospero Flow CRM before version 5.5.3 do not verify record ownership by the user's company, enabling reading, modifying, and deleting orders and order items belonging to other tenants.
- CVE-2026-59236Medium
A vulnerability in Prospero Flow CRM before version 5.14.0 allows an authenticated user to bypass authorization via a user-controlled key (CWE-639) in the Excel import functionality. An attacker can create customer, lead, and product records in another company's tenant by uploading a spreadsheet with a manipulated company_id column.
- CVE-2026-59235High
Missing authorization in BankAccountListController of Prospero Flow CRM below 5.5.3 allows an authenticated attacker with low privileges to read arbitrary bank account records via the API endpoint without proper role checks.
Original NVD description (English source)
Authorization Bypass Through User-Controlled Key (CWE-639) in CalendarDeleteEventController (app/Http/Controllers/Calendar/CalendarDeleteEventController.php), exposed at GET /calendar/event/delete/{id}, in Prospero Flow CRM before 5.5.3 allows a remote, authenticated attacker to delete arbitrary calendar events belonging to other users by manipulating the {id} path parameter, because the delete handler resolves the record with Calendar::find($id)->delete() and performs no ownership check (no user_id/company_id scoping) before deletion. This results in unauthorized destruction of other users' calendar events across the platform.