CVE-2026-59234

Name of the Vulnerable Software and Affected Versions Prospero Flow CRM versions prior to 5.5.3

Description An authorization bypass exists in the CalendarDeleteEventController (app/Http/Controllers/Calendar/CalendarDeleteEventController.php) via the GET '/calendar/event/delete/{id}' endpoint. A remote, authenticated attacker can delete arbitrary calendar events belonging to other users by manipulating the {id} path parameter. This occurs because the delete handler uses the Calendar::find($id)->delete() function without performing ownership checks, such as scoping by user id or company id, leading to unauthorized destruction of data across the platform.

Recommendations Update Prospero Flow CRM to version 5.5.3 or later. As a temporary mitigation, restrict access to the '/calendar/event/delete/{id}' endpoint.