An authenticated user can delete any calendar event by supplying the event id in the URL, because the delete handler simply finds the event and deletes it without checking ownership, classified as CWE-639. This allows an attacker to erase other users' scheduling data, compromising data integrity and potentially disrupting collaboration across the platform.

All releases of Roskus:Prospero Flow CRM before version 5.5.3 are affected, as the authorization bypass exists in every pre‑5.5.3 release; version 5.5.3 and later contain the fix that scopes deletion to the authenticated user or the user’s organization.

The CVSS score of 6.9 marks the vulnerability as a moderate risk. The EPSS score of < 1 % indicates that exploitation is currently rare, and the vulnerability is not listed in CISA KEV. Because the attack requires valid credentials and the attacker can manipulate the event ID in the URL, the risk remains significant in environments where users routinely exchange calendar events.