Vulnerability Description
Authorization Bypass Through User-Controlled Key (CWE-639) in CalendarDeleteEventController (app/Http/Controllers/Calendar/CalendarDeleteEventController.php), exposed at GET /calendar/event/delete/{id}, in Prospero Flow CRM before 5.5.3 allows a remote, authenticated attacker to delete arbitrary calendar events belonging to other users by manipulating the {id} path parameter, because the delete handler resolves the record with Calendar::find($id)->delete() and performs no ownership check (no user_id/company_id scoping) before deletion. This results in unauthorized destruction of other users' calendar events across the platform.
Related Weaknesses (CWE)
References
- https://github.com/Roskus/prospero-flow-crm/commit/8c26eed4d80544c30e55448e12a8e
- https://github.com/Roskus/prospero-flow-crm/releases/tag/v5.5.3
- https://secur0.com/en/cna/cve-list/cve-2026-59234-idor-in-prospero-flow-crm-allo
FAQ
What is CVE-2026-59234?
CVE-2026-59234 is a documented vulnerability. Authorization Bypass Through User-Controlled Key (CWE-639) in CalendarDeleteEventController (app/Http/Controllers/Calendar/CalendarDeleteEventController.php), exposed at GET /calendar/event/delete/{id...
How severe is CVE-2026-59234?
CVSS scoring is not yet available for CVE-2026-59234. Check NVD for updates.
Is there a patch for CVE-2026-59234?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.