Executive brief
Prospero Flow CRM is a customer relationship management platform used to manage business tasks and communications. A security flaw allows any logged-in user to delete notifications belonging to other users or companies by guessing sequential ID numbers. This could result in staff missing critical ticket alerts, task assignments, or system events, potentially disrupting business operations and internal communications.
Technical details
An Insecure Direct Object Reference (IDOR) exists in the `DeleteNotificationController::delete()` method at the `GET /notification/delete/{id}` endpoint. The root cause is the use of `Notification::findOrFail($id)` without verifying that the `user_id` or `company_id` associated with the notification matches the authenticated user's session. Because notification IDs are sequential, an authenticated attacker can perform a horizontal privilege escalation to systematically delete notifications across the entire system. This vulnerability was addressed in version 5.5.1 by scoping the database lookup to the authenticated user's ID.
Affected products
- Roskus Prospero Flow CRM 1.0.0 to 5.5.0
Timeline
- 2026-06-26: patched: Fix included in release v5.5.3
- 2026-07-27: disclosed: CVE published by Secur0 CNA
References
- https://github.com/Roskus/prospero-flow-crm
- https://github.com/Roskus/prospero-flow-crm/commit/eaee2ae018701d116164976cbfa37fa9294ab4cc
- https://github.com/Roskus/prospero-flow-crm/releases/tag/v5.5.3
- https://secur0.com/en/cna/cve-list/cve-2026-59240-idor-in-prospero-flow-crm-allows-deletion-of-other-users-notifications