CVE-2026-59234Disclosure

LOWCVSS 6.9 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Authorization Bypass Through User-Controlled Key (CWE-639) in CalendarDeleteEventController (app/Http/Controllers/Calendar/CalendarDeleteEventController.php), exposed at GET /calendar/event/delete/{id}, in Prospero Flow CRM before 5.5.3 allows a remote, authenticated attacker to delete arbitrary calendar events belonging to other users by manipulating the {id} path parameter, because the delete handler resolves the record with Calendar::find($id)->delete() and performs no ownership check (no user_id/company_id scoping) before deletion. This results in unauthorized destruction of other users' calendar events across the platform.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-639

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Threat summary

3 mentions across 2 observed days
Momentum state: stable

What's happening

Technical details provided in 3 signals
Disclosure: 3 classified signals
Peaked 1d ago at 2 mentions (2026-07-03); latest day: 1
3 total mentions across 2 days

Deep dive

Activity timeline3 mentions / 2d

Signal classification1 categories

Disclosure

3100.0%

Referenced assets3 URLs

By indicator

Classification over time

Date	Total	Labels

2026-07-03	2	Disclosure2
2026-07-04	1	Disclosure1

Full discourse3 posts

SystemTek - Technology news website@SystemTek_UK90d
Disclosure
Authorization Bypass Through User-Controlled Key in Prospero Flow CRM calendar event deletion (CVE-2026-59234) https://www.systemtek.co.uk/2026/07/authorization-bypass-through-user-controlled-key-in-prospero-flow-crm-calendar-event-deletion-cve-2026-59234/ via @SystemTek_UK
Post summary
The post announces CVE‑2026‑59234, an authorization bypass in Prospero Flow CRM via a user‑controlled key during calendar event deletions, but provides no PoC, exploit, or patch information.
0000048
1.8K followersView on X
Infoflowcloud@infoflowcloud91d
Disclosure
🚨*CVE* CVE-2026-59234 Authorization Bypass Through User-Controlled Key (CWE-639) in CalendarDeleteEventController (app/Http/Controllers/Calendar/CalendarDeleteEventController.php), exposed… https://www.cve.org/CVERecord?id=CVE-2026-59234 ----- Traducción: CVE-2026-59234 Byp… http://infoflow.cloud`
Post summary
The post announces the disclosure of CVE‑2026‑59234, outlining its authorization bypass nature without offering PoC, exploit, or mitigation details.
0000042
91 followersView on X
CVE@CVEnew91d
Disclosure
CVE-2026-59234 Authorization Bypass Through User-Controlled Key (CWE-639) in CalendarDeleteEventController (app/Http/Controllers/Calendar/CalendarDeleteEventController.php), exposed… https://www.cve.org/CVERecord?id=CVE-2026-59234
Post summary
The post announces a new CVE (CVE‑2026‑59234) describing an authorization bypass via user‑controlled key in a specific controller file, providing technical details and a link to the CVE record.
00000996
57.7K followersView on X

Explore more

Back to dashboard