CVE-2026-59234
- Source
- https://cve.org/CVERecord?id=CVE-2026-59234
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-59234.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-59234
- Published
- 2026-07-03T12:47:38Z
- Modified
- 2026-10-28T02:30:39Z
- Severity
-
- 6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- Authorization Bypass Through User-Controlled Key in Prospero Flow CRM calendar event deletion
- Details
-
Authorization Bypass Through User-Controlled Key (CWE-639) in CalendarDeleteEventController (app/Http/Controllers/Calendar/CalendarDeleteEventController.php), exposed at GET /calendar/event/delete/{id}, in Prospero Flow CRM before 5.5.3 allows a remote, authenticated attacker to delete arbitrary calendar events belonging to other users by manipulating the {id} path parameter, because the delete handler resolves the record with Calendar::find($id)->delete() and performs no ownership check (no user_id/company_id scoping) before deletion. This results in unauthorized destruction of other users' calendar events across the platform.
- Database specific
{ "cna_assigner": "Secur0", "cwe_ids": [ "CWE-639" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59234.json" }- References
-
- https://secur0.com/en/cna/cve-list/cve-2026-59234-idor-in-prospero-flow-crm-allows-deletion-of-other-users-calendar-events
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59234.json
- https://github.com/Roskus/prospero-flow-crm/releases/tag/v5.5.3
- https://nvd.nist.gov/vuln/detail/CVE-2026-59234
- https://github.com/Roskus/prospero-flow-crm/commit/8c26eed4d80544c30e55448e12a8e999af6d2b70
- https://github.com/Roskus/prospero-flow-crm
Affected packages
Git / github.com/roskus/prospero-flow-crm
Affected ranges
- Type
- GIT
- Repo
- https://github.com/roskus/prospero-flow-crm
- Events
- Database specific
-
Show details
{ "extracted_events": [ { "range": [ { "introduced": "1.0.0" }, { "fixed": "5.5.3" } ], "source": "AFFECTED_FIELD", "strategy": "StandardRange" }, { "range": [ { "fixed": "8c26eed4d80544c30e55448e12a8e999af6d2b70" } ], "source": "REFERENCES_COMMIT" }, { "original_tag": "v5.5.3", "range": [ { "fixed": "584f315878b8366244c95fe3cb016b3a63f05db8" } ], "source": "REFERENCES_TAG" } ] }