CVE-2026-59240

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-59240", "assignerOrgId": "4daa8cea-433a-44bd-9456-53b127fc289a", "state": "PUBLISHED", "assignerShortName": "Secur0", "dateReserved": "2026-07-03T11:24:39.242Z", "datePublished": "2026-07-27T21:37:33.747Z", "dateUpdated": "2026-07-28T14:19:25.325Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "4daa8cea-433a-44bd-9456-53b127fc289a", "shortName": "Secur0", "dateUpdated": "2026-07-27T21:37:33.747Z"}, "title": "IDOR in Prospero Flow CRM allows deletion of other users' notifications", "datePublic": "2026-07-27T15:11:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-639", "description": "CWE-639 Authorization bypass through User-Controlled key", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-122", "descriptions": [{"lang": "en", "value": "CAPEC-122 Privilege Abuse"}]}], "affected": [{"vendor": "Roskus", "product": "Prospero Flow CRM", "collectionURL": "https://github.com/Roskus/prospero-flow-crm", "repo": "https://github.com/Roskus/prospero-flow-crm", "programFiles": ["app/Http/Controllers/Notification/DeleteNotificationController.php"], "versions": [{"status": "affected", "version": "1.0.0", "lessThan": "5.5.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "cpeApplicability": [{"operator": "OR", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:roskus:prospero_flow_crm:*:*:*:*:*:*:*:*", "versionStartIncluding": "1.0.0", "versionEndExcluding": "5.5.1"}]}]}], "descriptions": [{"lang": "en", "value": "The vulnerability involves an Insecure Direct Object Reference (IDOR) in the `DeleteNotificationController::delete()` method at endpoint `GET /notification/delete/{id}`. The flaw allows any authenticated user, regardless of company or permissions, to delete notifications belonging to any other user in the system. The controller retrieves the target record with `Notification::findOrFail($id)` and deletes it without validating `user_id` or `company_id` ownership, unlike the sibling `SetNotificationReadAjaxController`, which correctly scopes lookups by `Auth::id()`. Because notification identifiers are sequential, an attacker can iterate over IDs to systematically delete notifications belonging to any user, denying them visibility of ticket alerts, task assignments, and other system events.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "The vulnerability involves an Insecure Direct Object Reference (IDOR) in the `DeleteNotificationController::delete()` method at endpoint `GET /notification/delete/{id}`. The flaw allows any authenticated user, regardless of company or permissions, to delete notifications belonging to any other user in the system. The controller retrieves the target record with `Notification::findOrFail($id)` and deletes it without validating `user_id` or `company_id` ownership, unlike the sibling `SetNotificationReadAjaxController`, which correctly scopes lookups by `Auth::id()`. Because notification identifiers are sequential, an attacker can iterate over IDs to systematically delete notifications belonging to any user, denying them visibility of ticket alerts, task assignments, and other system events."}]}], "tags": ["x_open-source"], "references": [{"url": "https://github.com/Roskus/prospero-flow-crm/commit/eaee2ae018701d116164976cbfa37fa9294ab4cc", "tags": ["patch"]}, {"url": "https://github.com/Roskus/prospero-flow-crm/releases/tag/v5.5.3", "tags": ["release-notes"]}, {"url": "https://secur0.com/en/cna/cve-list/cve-2026-59240-idor-in-prospero-flow-crm-allows-deletion-of-other-users-notifications", "tags": ["technical-description"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "MEDIUM", "baseScore": 6.9, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"}}], "solutions": [{"lang": "en", "value": "Upgrade to version 5.5.1 or higher.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Upgrade to version 5.5.1 or higher."}]}], "credits": [{"lang": "en", "value": "Dario Rivas Quero", "type": "finder"}, {"lang": "en", "value": "Cristian Fernandez Cornejo", "type": "analyst"}, {"lang": "en", "value": "Xoan M. Otero Jorge", "type": "analyst"}, {"lang": "en", "value": "Gustavo Novaro", "type": "remediation developer"}, {"lang": "en", "value": "Secur0 CNA", "type": "coordinator"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 1.0.4"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-28T14:19:12.811494Z", "id": "CVE-2026-59240", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-28T14:19:25.325Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-59240", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-28T14:19:12.811494Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-28T14:19:18.579Z"}}], "cna": {"tags": ["x_open-source"], "title": "IDOR in Prospero Flow CRM allows deletion of other users' notifications", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Dario Rivas Quero"}, {"lang": "en", "type": "analyst", "value": "Cristian Fernandez Cornejo"}, {"lang": "en", "type": "analyst", "value": "Xoan M. Otero Jorge"}, {"lang": "en", "type": "remediation developer", "value": "Gustavo Novaro"}, {"lang": "en", "type": "coordinator", "value": "Secur0 CNA"}], "impacts": [{"capecId": "CAPEC-122", "descriptions": [{"lang": "en", "value": "CAPEC-122 Privilege Abuse"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/Roskus/prospero-flow-crm", "vendor": "Roskus", "product": "Prospero Flow CRM", "versions": [{"status": "affected", "version": "1.0.0", "lessThan": "5.5.1", "versionType": "semver"}], "programFiles": ["app/Http/Controllers/Notification/DeleteNotificationController.php"], "collectionURL": "https://github.com/Roskus/prospero-flow-crm", "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Upgrade to version 5.5.1 or higher.", "supportingMedia": [{"type": "text/html", "value": "Upgrade to version 5.5.1 or higher.", "base64": false}]}], "datePublic": "2026-07-27T15:11:00.000Z", "references": [{"url": "https://github.com/Roskus/prospero-flow-crm/commit/eaee2ae018701d116164976cbfa37fa9294ab4cc", "tags": ["patch"]}, {"url": "https://github.com/Roskus/prospero-flow-crm/releases/tag/v5.5.3", "tags": ["release-notes"]}, {"url": "https://secur0.com/en/cna/cve-list/cve-2026-59240-idor-in-prospero-flow-crm-allows-deletion-of-other-users-notifications", "tags": ["technical-description"]}], "x_generator": {"engine": "Vulnogram 1.0.4"}, "descriptions": [{"lang": "en", "value": "The vulnerability involves an Insecure Direct Object Reference (IDOR) in the `DeleteNotificationController::delete()` method at endpoint `GET /notification/delete/{id}`. The flaw allows any authenticated user, regardless of company or permissions, to delete notifications belonging to any other user in the system. The controller retrieves the target record with `Notification::findOrFail($id)` and deletes it without validating `user_id` or `company_id` ownership, unlike the sibling `SetNotificationReadAjaxController`, which correctly scopes lookups by `Auth::id()`. Because notification identifiers are sequential, an attacker can iterate over IDs to systematically delete notifications belonging to any user, denying them visibility of ticket alerts, task assignments, and other system events.", "supportingMedia": [{"type": "text/html", "value": "The vulnerability involves an Insecure Direct Object Reference (IDOR) in the `DeleteNotificationController::delete()` method at endpoint `GET /notification/delete/{id}`. The flaw allows any authenticated user, regardless of company or permissions, to delete notifications belonging to any other user in the system. The controller retrieves the target record with `Notification::findOrFail($id)` and deletes it without validating `user_id` or `company_id` ownership, unlike the sibling `SetNotificationReadAjaxController`, which correctly scopes lookups by `Auth::id()`. Because notification identifiers are sequential, an attacker can iterate over IDs to systematically delete notifications belonging to any user, denying them visibility of ticket alerts, task assignments, and other system events.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-639", "description": "CWE-639 Authorization bypass through User-Controlled key"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:roskus:prospero_flow_crm:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.5.1", "versionStartIncluding": "1.0.0"}], "operator": "OR"}], "operator": "OR"}], "providerMetadata": {"orgId": "4daa8cea-433a-44bd-9456-53b127fc289a", "shortName": "Secur0", "dateUpdated": "2026-07-27T21:37:33.747Z"}}}, "cveMetadata": {"cveId": "CVE-2026-59240", "state": "PUBLISHED", "dateUpdated": "2026-07-28T14:19:25.325Z", "dateReserved": "2026-07-03T11:24:39.242Z", "assignerOrgId": "4daa8cea-433a-44bd-9456-53b127fc289a", "datePublished": "2026-07-27T21:37:33.747Z", "assignerShortName": "Secur0"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://github.com/Roskus/prospero-flow-crm", "defaultStatus": "unaffected", "product": "Prospero Flow CRM", "programFiles": ["app/Http/Controllers/Notification/DeleteNotificationController.php"], "repo": "https://github.com/Roskus/prospero-flow-crm", "vendor": "Roskus", "versions": [{"lessThan": "5.5.1", "status": "affected", "version": "1.0.0", "versionType": "semver"}]}], "source": "4daa8cea-433a-44bd-9456-53b127fc289a"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The vulnerability involves an Insecure Direct Object Reference (IDOR) in the `DeleteNotificationController::delete()` method at endpoint `GET /notification/delete/{id}`. The flaw allows any authenticated user, regardless of company or permissions, to delete notifications belonging to any other user in the system. The controller retrieves the target record with `Notification::findOrFail($id)` and deletes it without validating `user_id` or `company_id` ownership, unlike the sibling `SetNotificationReadAjaxController`, which correctly scopes lookups by `Auth::id()`. Because notification identifiers are sequential, an attacker can iterate over IDs to systematically delete notifications belonging to any user, denying them visibility of ticket alerts, task assignments, and other system events."}, {"lang": "es", "value": "La vulnerabilidad implica una Referencia Directa Insegura a Objeto (IDOR) en el m\u00e9todo \u201cDeleteNotificationController::delete()\u201d en el endpoint \u201cGET /notification/delete/{id}\u201d. La falla permite a cualquier usuario autenticado, independientemente de la empresa o los permisos, eliminar notificaciones pertenecientes a cualquier otro usuario en el sistema. El controlador recupera el registro objetivo con \u201cNotification::findOrFail($id)\u201d y lo elimina sin validar la propiedad de \u201cuser_id\u201d o \u201ccompany_id\u201d, a diferencia del controlador hermano \u201cSetNotificationReadAjaxController\u201d, que correctamente limita las b\u00fasquedas por \u201cAuth::id()\u201d. Debido a que los identificadores de notificaci\u00f3n son secuenciales, un atacante puede iterar sobre los IDs para eliminar sistem\u00e1ticamente notificaciones pertenecientes a cualquier usuario, neg\u00e1ndoles la visibilidad de alertas de tickets, asignaciones de tareas y otros eventos del sistema."}], "id": "CVE-2026-59240", "lastModified": "2026-10-24T13:10:00.147", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.9, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "4daa8cea-433a-44bd-9456-53b127fc289a", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-59240", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-28T14:19:12.811494Z", "version": "2.0.3"}}]}, "published": "2026-07-27T22:17:54.713", "references": [{"source": "4daa8cea-433a-44bd-9456-53b127fc289a", "url": "https://github.com/Roskus/prospero-flow-crm/commit/eaee2ae018701d116164976cbfa37fa9294ab4cc"}, {"source": "4daa8cea-433a-44bd-9456-53b127fc289a", "url": "https://github.com/Roskus/prospero-flow-crm/releases/tag/v5.5.3"}, {"source": "4daa8cea-433a-44bd-9456-53b127fc289a", "url": "https://secur0.com/en/cna/cve-list/cve-2026-59240-idor-in-prospero-flow-crm-allows-deletion-of-other-users-notifications"}], "sourceIdentifier": "4daa8cea-433a-44bd-9456-53b127fc289a", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-639"}], "source": "4daa8cea-433a-44bd-9456-53b127fc289a", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.0.0,5.5.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "inferred", "scores": [{"score": 100.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Prospero Flow CRM", "source": "cna", "vendor": "Roskus"}, "product": "prospero_flow_crm", "vendor": "roskus"}], "created": "2026-07-28T02:00:05.993630+00:00", "updated": "2026-08-03T15:45:04.167294+00:00", "vendors": ["roskus", "roskus$PRODUCT$prospero_flow_crm"]}