CVE-2026-59240

Name of the Vulnerable Software and Affected Versions Prospero Flow CRM (affected versions not specified)

Description An Insecure Direct Object Reference (IDOR) exists in the DeleteNotificationController::delete() method at the GET /notification/delete/{id} endpoint. This flaw allows any authenticated user to delete notifications belonging to any other user in the system, regardless of their company or permissions. The issue occurs because the controller uses Notification::findOrFail($id) to retrieve records without validating the user id or company id ownership. Since notification identifiers are sequential, an attacker can iterate through IDs to systematically delete notifications, preventing users from seeing ticket alerts, task assignments, and other system events.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the GET /notification/delete/{id} endpoint to prevent unauthorized deletion of notifications.