Is CVE-2026-59234 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-59234 being exploited in the wild.

How severe is CVE-2026-59234?

Informational severity, with a CVSS score of 6.9, published 3 July 2026.

Which products and versions are affected?

Roskus Prospero Flow CRM before 5.5.3.

Is there a fix for CVE-2026-59234?

A patch was published on 2026-06-25: Fix committed to repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-59234 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-59234?

Check whether you run Roskus Prospero Flow CRM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-59234: Roskus Prospero Flow CRM authorization bypass in CalendarDeleteEventController

CVE-2026-59234 · Severity: info · CVSS 6.9 · Published 2026-07-03

Prospero Flow CRM, a customer relationship management platform, contains a security flaw that allows users to delete calendar events belonging to other people or companies. By simply changing the ID number in a specific web link, an authenticated user can permanently remove data they do not own. This could lead to significant data loss and disruption of business schedules across the entire platform.

Technologies: Roskus Prospero Flow CRM. Vendors: Roskus.

Quick answers

Is CVE-2026-59234 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-59234 being exploited in the wild.
How severe is CVE-2026-59234?: Informational severity, with a CVSS score of 6.9, published 3 July 2026.
Which products and versions are affected?: Roskus Prospero Flow CRM before 5.5.3.
Is there a fix for CVE-2026-59234?: A patch was published on 2026-06-25: Fix committed to repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-59234 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-59234?: Check whether you run Roskus Prospero Flow CRM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An Authorization Bypass Through User-Controlled Key (CWE-639), also known as IDOR, exists in the CalendarDeleteEventController (app/Http/Controllers/Calendar/CalendarDeleteEventController.php). The application exposes a deletion endpoint at GET /calendar/event/delete/{id} which uses the Eloquent find($id)->delete() method without verifying if the authenticated user owns the record or belongs to the same company. An attacker can iterate through ID values to delete events across different tenants. The vulnerability was addressed in version 5.5.3 by implementing ownership scoping (user_id and company_id checks) before executing the delete command.

Affected products

Roskus Prospero Flow CRM before 5.5.3

Timeline

2026-06-25: patched: Fix committed to repository
2026-06-26: advisory: Release v5.5.3 published
2026-07-03: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.