IDOR in Prospero Flow CRM allows deletion of other users' calendar events

Description

Authorization Bypass Through User-Controlled Key (CWE-639) in CalendarDeleteEventController (app/Http/Controllers/Calendar/CalendarDeleteEventController.php), exposed at GET /calendar/event/delete/{id}, in Prospero Flow CRM <5.5.3, which allows a remote, authenticated attacker to delete arbitrary calendar events belonging to other users by manipulating the {id} path parameter, because the delete handler resolves the record with Calendar::find($id)->delete() and performs no ownership check (no user_id/company_id scoping) before deletion. This results in the unauthorized destruction of other users' calendar events across the platform.

Vulnerability type (CWE)

CWE-639: Authorization Bypass Through User-Controlled Key

Affected versions

Prospero Flow CRM before 5.5.3 (all versions prior to 5.5.3). Default status: unaffected.

Score (CVSS 4.0)

Medium

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Solution

Upgrade to version 5.5.3 or higher.

Patch

Commit 8c26eed4

Credits

• Robert Mihaila — finder
• Amirreza Fadaeizadeh Bidari — finder
• Xoán M. Otero Jorge — analyst
• Secur0 CNA — coordinator
• Gustavo Novaro — remediation developer Discovery source: External

Official record: CVE-2026-59234