Robert Mihaila

**Name of the Vulnerable Software and Affected Versions** Roskus Prospero Flow CRM versions prior to 5.4.4 **Description** The email module contains a stored cross-site scripting issue. A remote, authenticated user with low privileges can execute arbitrary JavaScript in the browser of another user, including administrators, by storing a malicious payload in an email body. This occurs because the email body is persisted without sanitization and rendered unescaped using `{!! $email->body !!}` when the recipient opens the message, which can lead to session compromise and account takeover. **Recommendations** Update Roskus Prospero Flow CRM to version 5.4.4 or later.

**Name of the Vulnerable Software and Affected Versions** Prospero Flow CRM versions prior to 5.5.3 **Description** An authorization bypass exists in the `CalendarDeleteEventController` (app/Http/Controllers/Calendar/CalendarDeleteEventController.php) via the GET '/calendar/event/delete/{id}' endpoint. A remote, authenticated attacker can delete arbitrary calendar events belonging to other users by manipulating the `{id}` path parameter. This occurs because the delete handler uses the `Calendar::find($id)->delete()` function without performing ownership checks, such as scoping by `user id` or `company id`, leading to unauthorized destruction of data across the platform. **Recommendations** Update Prospero Flow CRM to version 5.5.3 or later. As a temporary mitigation, restrict access to the '/calendar/event/delete/{id}' endpoint.