CVE-2026-59240

Received Received - Intake

Insecure Direct Object Reference in Notification System

Publication date: 2026-07-27

Last updated on: 2026-07-28

Assigner: 4daa8cea-433a-44bd-9456-53b127fc289a

Description

The vulnerability involves an Insecure Direct Object Reference (IDOR) in the `DeleteNotificationController::delete()` method at endpoint `GET /notification/delete/{id}`. The flaw allows any authenticated user, regardless of company or permissions, to delete notifications belonging to any other user in the system. The controller retrieves the target record with `Notification::findOrFail($id)` and deletes it without validating `user_id` or `company_id` ownership, unlike the sibling `SetNotificationReadAjaxController`, which correctly scopes lookups by `Auth::id()`. Because notification identifiers are sequential, an attacker can iterate over IDs to systematically delete notifications belonging to any user, denying them visibility of ticket alerts, task assignments, and other system events.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-27

Last Modified

2026-07-28

Generated

2026-08-17

AI Q&A

2026-07-28

EPSS Evaluated

2026-08-16

NVD

CVE-2026-59240

EUVD

EUVD-2026-49632

Affected Vendors & Products

Vendor	Product	Version / Range
roskus	prospero_flow_crm	5.5.1
roskus	prospero_flow_crm	5.5.3

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

This is an Insecure Direct Object Reference (IDOR) vulnerability in a notification deletion endpoint. It allows any authenticated user to delete notifications belonging to other users without proper authorization checks. The flaw occurs because the system does not validate ownership of the notification before deletion, enabling attackers to iterate over sequential IDs and systematically remove alerts for any user.

Detection Guidance

Check web server logs for suspicious GET requests to /notification/delete/{id} with sequential IDs. Monitor for unusual deletion patterns or missing notifications reported by users. Use tools like Burp Suite or OWASP ZAP to intercept and analyze requests to this endpoint.

Impact Analysis

An attacker could exploit this to delete critical notifications for other users, such as ticket alerts or task assignments. This could lead to missed deadlines, overlooked tasks, or loss of visibility into important system events, disrupting normal operations and causing confusion or errors in workflow.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA by enabling unauthorized deletion of user notifications. GDPR requires data integrity and access controls, while HIPAA mandates protection of sensitive health-related alerts. Unauthorized deletion may violate these standards by denying users access to critical notifications or altering audit trails.

Mitigation Strategies

Implement proper authorization checks in the DeleteNotificationController to ensure users can only delete their own notifications. Update the controller to validate user_id or company_id ownership before deletion. Consider rate-limiting the endpoint to prevent bulk deletions.

Hi! I’m here to help you understand CVE-2026-59240. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70