CVE-2026-71242

Published: Aug 5, 2026Modified: Aug 26, 2026Deferred

8.3

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

Exploitability: 2.8 / Impact: 5.5

Source: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c (Secondary)

Description

Crater's NotePolicy checks only a blanket Bouncer ability (manage-all-notes / view-all-notes) with no company-ownership comparison, unlike InvoicePolicy and other sibling policies which additionally verify ->hasCompany(->company_id). Any authenticated user of one company can read, edit, or delete another company's notes by ID.

Related CWEs

CWE-639

Authorization Bypass Through User-Controlled Key

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

References (1)

https://github.com/crater-invoice/crater

Source: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

Timeline

No history available yet.