Skip to content
Secur0
Solutions
AI Agent Security New Protect your AI agents Vulnerability Disclosure Secure reporting channel Penetration Testing Expert manual audits Crowdsourced Pentest Thousands of hackers, one goal Bug Bounty Success-based payment Live Hacking Live real-time pentesting For company teams Train your technical team For educational centers Bring hacking to the classroom For hackers Learn and get certified Competitions / CTFs Put your skills to the test
Customer Stories
Edtech Success in education Penetration Testing Manual pentesting VDP Secure reporting channel Pentest In-depth audits Crowdsourced Pentest Thousands of hackers, one goal Bug Bounty Success-based payment
Resources
About Secur0 Get to know us Careers Join the team Media Kit Brand resources Contact Talk to us Newsletter Industry news Blog Articles and guides Partners Join the partner network We are a CNA We are a CVE Numbering Authority
Are you a hacker?
Request a demo Log in
Español English
Back to list
CVE-2026-59240 ·
Medium · July 27, 2026

IDOR in Prospero Flow CRM allows deletion of other users notifications

S0
Secur0 CNA
CVE-2026-59240

Description

Authorization Bypass Through User-Controlled Key (CWE-639) in DeleteNotificationController (app/Http/Controllers/Notification/DeleteNotificationController.php), exposed at GET /notification/delete/{id}, in Prospero Flow CRM <5.5.1, which allows any authenticated user, regardless of company or permissions, to delete notifications belonging to any other user in the system, because the delete() method retrieves the record with Notification::findOrFail($id) and deletes it without validating user_id or company_id ownership, unlike the sibling SetNotificationReadAjaxController, which correctly scopes lookups by Auth::id(). Because notification identifiers are sequential, an attacker can iterate over IDs to systematically delete notifications belonging to any user, denying them visibility of ticket alerts, task assignments, and other system events.

Vulnerability type (CWE)

CWE-639: Authorization Bypass Through User-Controlled Key

Affected versions

Prospero Flow CRM before 5.5.1 (all versions prior to 5.5.1). The flaw has been present since 1.0.0 and was fixed in 5.5.1 (first tagged release including it: v5.5.3). Default status: unaffected.

Score (CVSS 4.0)

Medium

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Solution

Upgrade to version 5.5.1 or higher.

Patch

Commit eaee2ae0

Credits

  • Dario Rivas Quero - finder
  • Cristian Fernandez Cornejo - analyst
  • Xoán M. Otero Jorge - analyst
  • Secur0 CNA - coordinator
  • Gustavo Novaro - remediation developer Discovery source: External Official record: CVE-2026-59240