Auth bypass in Roskus Prospero Flow Crm

CVE-2026-59234

Authorization Bypass Through User-Controlled Key (CWE-639) in CalendarDeleteEventController (app/Http/Controllers/Calendar/CalendarDeleteEventController.php), exposed at GET /calendar/event/delete/{id}, in Prospero Flow CRM before 5.5.3 al…

Vulnerability class: IDOR (Insecure Direct Object Reference)