CVE-2026-59240 IDOR in Prospero Flow CRM allows deletion of other users' notifications
Authenticated users can delete other users' notifications via IDOR, causing loss of critical alerts and system events.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-59240?
CVE-2026-59240 is a medium-severity missing authorization vulnerability in Roskus Prospero Flow CRM, published on 27 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The vulnerability involves an Insecure Direct Object Reference (IDOR) in the `DeleteNotificationController::delete()` method at endpoint `GET /notification/delete/{id}`. The flaw allows any authenticated user, regardless of company or permissions, to delete notifications belonging to any other user in the system. The controller retrieves the target record with `Notification::findOrFail($id)` and deletes it without validating `user_id` or `company_id` ownership, unlike the sibling `SetNotificationReadAjaxController`, which correctly scopes lookups by `Auth::id()`. Because notification identifiers are sequential, an attacker can iterate over IDs to systematically delete notifications belonging to any user, denying them visibility of ticket alerts, task assignments, and other system events.
Weakness: CWE-639
Which versions are affected by CVE-2026-59240?
How do I fix CVE-2026-59240?
No fix has been published for CVE-2026-59240 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-59240 being exploited?
There is no known exploitation of CVE-2026-59240 in the wild and no public exploit code.
Sources
Also known as GHSA-m6x4-f6j4-9qq6.