CVE-2026-59240

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-59240

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-59240.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-59240

Published

2026-07-27T21:37:33Z

Modified

2026-09-03T03:30:47Z

Severity

6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

IDOR in Prospero Flow CRM allows deletion of other users' notifications

Details

The vulnerability involves an Insecure Direct Object Reference (IDOR) in the DeleteNotificationController::delete() method at endpoint GET /notification/delete/{id}. The flaw allows any authenticated user, regardless of company or permissions, to delete notifications belonging to any other user in the system. The controller retrieves the target record with Notification::findOrFail($id) and deletes it without validating user_id or company_id ownership, unlike the sibling SetNotificationReadAjaxController, which correctly scopes lookups by Auth::id(). Because notification identifiers are sequential, an attacker can iterate over IDs to systematically delete notifications belonging to any user, denying them visibility of ticket alerts, task assignments, and other system events.

Database specific

{
    "cna_assigner": "Secur0",
    "cwe_ids": [
        "CWE-639"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59240.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "1.0.0"
                },
                {
                    "fixed": "5.5.1"
                }
            ],
            "source": "AFFECTED_FIELD"
        },
        {
            "extracted_events": [
                {
                    "introduced": "1.0.0"
                },
                {
                    "fixed": "5.5.1"
                }
            ],
            "source": "CPE_FIELD"
        }
    ]
}

References

Affected packages

Git / github.com/roskus/prospero-flow-crm

Affected ranges

Type

GIT

Repo

https://github.com/roskus/prospero-flow-crm

Events

Introduced

Fixed

eaee2ae018701d116164976cbfa37fa9294ab4cc

Fixed

584f315878b8366244c95fe3cb016b3a63f05db8

Database specific

Show details

{
    "source": "REFERENCES"
}

Affected versions

v1.*

v1.0.0

v2.*

v2.0.1

v4.*

v4.6.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-59240.json"