# CVE-2026-59234: Roskus Prospero Flow CRM authorization bypass in CalendarDeleteEventController

Source: https://junglewise.ai/threats/cve-2026-59234-roskus-prospero-flow-crm-authorization-bypass-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-03. Updated: 2026-07-03  
License: CC BY 4.0 with a link back

CVE-2026-59234 · Severity: info · CVSS 6.9 · Published 2026-07-03

Prospero Flow CRM, a customer relationship management platform, contains a security flaw that allows users to delete calendar events belonging to other people or companies. By simply changing the ID number in a specific web link, an authenticated user can permanently remove data they do not own. This could lead to significant data loss and disruption of business schedules across the entire platform.

Technologies: [Roskus Prospero Flow CRM](https://junglewise.ai/threats/technologies/prospero-flow-crm). Vendors: [Roskus](https://junglewise.ai/threats/vendors/roskus).

## Quick answers

**Is CVE-2026-59234 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-59234 being exploited in the wild.

**How severe is CVE-2026-59234?** Informational severity, with a CVSS score of 6.9, published 3 July 2026.

**Which products and versions are affected?** Roskus Prospero Flow CRM before 5.5.3.

**Is there a fix for CVE-2026-59234?** A patch was published on 2026-06-25: Fix committed to repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-59234 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-59234?** Check whether you run Roskus Prospero Flow CRM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An Authorization Bypass Through User-Controlled Key (CWE-639), also known as IDOR, exists in the CalendarDeleteEventController (app/Http/Controllers/Calendar/CalendarDeleteEventController.php). The application exposes a deletion endpoint at GET /calendar/event/delete/{id} which uses the Eloquent find($id)->delete() method without verifying if the authenticated user owns the record or belongs to the same company. An attacker can iterate through ID values to delete events across different tenants. The vulnerability was addressed in version 5.5.3 by implementing ownership scoping (user_id and company_id checks) before executing the delete command.

## Affected products

- Roskus Prospero Flow CRM before 5.5.3

## Timeline

- 2026-06-25: patched: Fix committed to repository
- 2026-06-26: advisory: Release v5.5.3 published
- 2026-07-03: disclosed: CVE published to NVD

## References

- [https://github.com/Roskus/prospero-flow-crm](https://github.com/Roskus/prospero-flow-crm)
- [https://github.com/Roskus/prospero-flow-crm/commit/8c26eed4d80544c30e55448e12a8e999af6d2b70](https://github.com/Roskus/prospero-flow-crm/commit/8c26eed4d80544c30e55448e12a8e999af6d2b70)
- [https://github.com/Roskus/prospero-flow-crm/releases/tag/v5.5.3](https://github.com/Roskus/prospero-flow-crm/releases/tag/v5.5.3)
- [https://secur0.com/en/cna/cve-list/cve-2026-59234-idor-in-prospero-flow-crm-allows-deletion-of-other-users-calendar-events](https://secur0.com/en/cna/cve-list/cve-2026-59234-idor-in-prospero-flow-crm-allows-deletion-of-other-users-calendar-events)

## Related threats

- [Roskus Prospero Flow CRM authorization bypass in user API](https://junglewise.ai/threats/cve-2026-114519-missing-authorization-cwe-862-in-the-user-api-of-roskus-prospero)
- [Roskus Prospero Flow CRM cross-site request forgery in order confirmation](https://junglewise.ai/threats/cve-2026-82911-roskus-prospero-flow-crm-cross-site-request-forgery-in-order)
- [Roskus Prospero Flow CRM stored XSS in product photo upload](https://junglewise.ai/threats/cve-2026-81931-roskus-prospero-flow-crm-stored-xss-in-product-photo-upload)
- [Roskus Prospero Flow CRM authorization bypass in supplier API](https://junglewise.ai/threats/cve-2026-78365-roskus-prospero-flow-crm-authorization-bypass-in-supplier-api)
- [Roskus Prospero Flow CRM stored XSS in company logo upload](https://junglewise.ai/threats/cve-2026-78337-roskus-prospero-flow-crm-stored-xss-in-company-logo-upload)