Auth bypass in Roskus Prospero Flow Crm

CVE-2026-59240

The vulnerability involves an Insecure Direct Object Reference (IDOR) in the `DeleteNotificationController::delete()` method at endpoint `GET /notification/delete/{id}`. The flaw allows any authenticated user, regardless of company or perm…

Vulnerability class: IDOR (Insecure Direct Object Reference)