An authenticated user can delete any calendar event by supplying the event id in the URL, because the delete handler simply finds classified as CWE-639, permits an attacker to erase other users' scheduling data, compromising data integrity and potentially disrupting collaboration across the platform.

All releases of Roskus:Prospero Flow CRM before version 5.5.3 are affected, as the authorization bypass exists in every pre‑5.5.3 release; version 5.5.3 and later contain the fix that scours ownership before deletion.

The CVSS score of 6.9 marks the vulnerability as a moderate risk. The EPSS score of <1% indicates that exploitation is currently rare, and the vulnerability is not listed in CISA KEV. Because the attack requires valid credentials and the attacker can manipulate the event ID in the URL, the risk remains significant in environments where users routinely exchange calendar events.