This vulnerability is an Insecure Direct Object Reference (IDOR) in the DeleteNotificationController::delete() method at the GET /notification/delete/{id} endpoint in Roskus Prospero Flow CRM 1.0.0. The controller uses Notification::findOrFail($id) to retrieve the notification and deletes it without validating that the notification belongs to the authenticated user or their company. Unlike the related SetNotificationReadAjaxController, which properly scopes notifications by authenticated user ID, this flaw allows any authenticated user to delete notifications of any other user. Because notification IDs are sequential, an attacker can enumerate IDs to delete notifications system-wide, causing denial of visibility to important system events for other users.

An attacker with any authenticated user account can delete notifications belonging to other users, potentially disrupting communication and visibility of critical system events such as ticket alerts and task assignments. This leads to an authorization bypass and denial of service on notification visibility for affected users. There is no indication of privilege escalation or data disclosure beyond notification deletion.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the notification deletion endpoint to only authorized users and implement server-side validation to ensure that users can only delete notifications they own. Review and update the DeleteNotificationController::delete() method to validate user_id and company_id ownership before deletion.