The issue is an Insecure Direct Object Reference that enables any authenticated user to delete notifications belonging to any other user. The controller responsible for deletion performs a lookup by notification ID and removes the record without verifying the owner or company. Consequently, the attacker can erase alerts, ticket notifications, and task assignments for other users, effectively denying them visibility of important system events. The weakness corresponds to CWE-639, reflecting a lack of proper authorization checks.

Roskus Prospero Flow CRM is affected. The vulnerability exists in releases prior to version 5.5.1; users on those versions can exploit it by issuing delete requests to the notification endpoint.

With a base CVSS score of 6.9, the flaw presents moderate severity. The EPSS score is < 1%, and it is not listed in the CISA KEV catalog, suggesting that a large‑scale, proactive exploitation is not yet reported. However, the vulnerability requires only authentication and sequential notification identifiers, making it straightforward to scan and delete notifications for any user if the attacker has legitimate access. The attack vector is likely internal or external but authenticated. Because the system fails to enforce ownership checks, the risk to confidentiality (loss of notification data) and availability (denial of essential notifications) can be significant for affected users.