CVE-2026-59234: Prospero Flow CRM Auth Bypass Vulnerability

CVE-2026-59234 Overview

CVE-2026-59234 is an Authorization Bypass Through User-Controlled Key vulnerability [CWE-639] in Prospero Flow CRM before version 5.5.3. The flaw resides in CalendarDeleteEventController (app/Http/Controllers/Calendar/CalendarDeleteEventController.php), exposed at GET /calendar/event/delete/{id}. The delete handler resolves records using Calendar::find($id)->delete() without any ownership verification. A remote, authenticated attacker can delete arbitrary calendar events belonging to other users by manipulating the {id} path parameter. This Insecure Direct Object Reference (IDOR) issue impacts data integrity and availability across all tenants on the platform.

Critical Impact

Any authenticated user can destroy calendar events belonging to other users or companies across the platform by iterating the {id} path parameter.

Affected Products

• Prospero Flow CRM versions prior to 5.5.3
• CalendarDeleteEventController component at GET /calendar/event/delete/{id}
• Additional delete controllers patched in the same commit (e.g., BrandDeleteController)

Discovery Timeline

• 2026-07-03 - CVE-2026-59234 published to NVD
• 2026-07-06 - Last updated in NVD database

Technical Details for CVE-2026-59234

Vulnerability Analysis

The vulnerability is a classic Insecure Direct Object Reference (IDOR) issue in a Laravel-based CRM. The delete action accepts an integer id from the URL path and passes it directly to Eloquent's find() method. No query scoping restricts the lookup to records owned by the authenticated user. Any authenticated session, regardless of privilege level, can invoke the endpoint against arbitrary event IDs. The result is unauthorized deletion of calendar events belonging to other users and companies on the same instance.

Root Cause

The controller performed record resolution without applying tenancy or ownership constraints. The original implementation called Calendar::find($id)->delete(), trusting the client-supplied identifier without cross-referencing it to Auth::user()->id or company_id. This violates the principle of enforcing authorization checks server-side on every state-changing request.

Attack Vector

Exploitation requires an authenticated session but no elevated privileges. An attacker enumerates numeric event IDs and issues GET /calendar/event/delete/{id} requests for each. Each request permanently removes the referenced calendar event, regardless of its owner. Automation of the enumeration causes bulk destruction of scheduling data across the tenant base.

// Vulnerable code (pre-5.5.3) in app/Http/Controllers/Calendar/CalendarDeleteEventController.php
class CalendarDeleteEventController extends MainController
{
    public function delete(Request $request, int $id)
    {
        Calendar::find($id)->delete();

        return back();
    }
}

Source: GitHub Commit Log

Detection Methods for CVE-2026-59234

Indicators of Compromise

• Sequential or non-sequential enumeration of GET /calendar/event/delete/{id} requests from a single authenticated session
• Unexpected disappearance of calendar events reported by multiple users within a short window
• HTTP 302 redirects returned from /calendar/event/delete/{id} for IDs not owned by the requesting user
• Laravel query logs showing DELETE FROM calendar WHERE id = ? statements without a user_id predicate

Detection Strategies

• Instrument application logs to record user_id of the caller alongside the target id on every delete request, then alert on mismatches
• Correlate authentication events with high-volume calls to /calendar/event/delete/{id} originating from the same session
• Deploy a WAF rule that rate-limits GET requests to any /calendar/event/delete/{id} path per authenticated user

Monitoring Recommendations

• Baseline the normal deletion rate per user and alert on statistical deviations
• Enable Laravel query logging in production for delete operations against the calendar table
• Retain web server access logs for at least 90 days to support forensic reconstruction of enumeration attempts

How to Mitigate CVE-2026-59234

Immediate Actions Required

• Upgrade Prospero Flow CRM to version 5.5.3 or later, which introduces ownership scoping on delete endpoints
• Review application audit logs for prior calls to /calendar/event/delete/{id} that referenced records not owned by the requesting user
• Restore missing calendar events from the most recent backup where possible
• Rotate authenticated session credentials if unauthorized deletions are confirmed

Patch Information

The fix is available in GitHub Release v5.5.3. The patch applies ownership scoping across all destructive endpoints, as documented in the GitHub Commit Log. For CalendarDeleteEventController, the resolver now uses Calendar::where('id', $id)->where('user_id', Auth::user()->id)->firstOrFail()->delete(), which returns a 404 when the target record is not owned by the caller.

Workarounds

• If patching is not immediately possible, remove or restrict route access to /calendar/event/delete/{id} at the reverse proxy or Laravel middleware layer
• Add a custom middleware that verifies Auth::user()->id matches the target record's user_id before dispatching the controller
• Convert the destructive route from GET to POST with CSRF enforcement to reduce accidental or link-based exploitation

// Fixed code in 5.5.3 - Source: https://github.com/Roskus/prospero-flow-crm/commit/8c26eed4d80544c30e55448e12a8e999af6d2b70
use Illuminate\Support\Facades\Auth;

class CalendarDeleteEventController extends MainController
{
    public function delete(Request $request, int $id)
    {
        Calendar::where('id', $id)
            ->where('user_id', Auth::user()->id)
            ->firstOrFail()
            ->delete();

        return back();
    }
}