Crater's NotePolicy checks only a blanket Bouncer ability (manage-all-notes / view-all-notes) with no company-ownership comparison, unlike InvoicePolicy and other sibling policies which additionally verify ->hasCompany(->company_id). Any authenticated user of one company can read, edit, or delete another company's notes by ID.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Crater-invoice-inc |
|
No data.
No data.
References
| Link | Providers |
|---|---|
| https://github.com/crater-invoice/crater |
|
History
Mon, 10 Aug 2026 12:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Crater's NotePolicy checks only a blanket Bouncer ability (manage-all-notes / view-all-notes) with no company-ownership comparison, unlike InvoicePolicy and other sibling policies which additionally verify $user->hasCompany($model->company_id). NotesController's show(), update(), and destroy() actions authorize via $this->authorize('view notes'/'manage notes') without passing the target Note model, and Note's company-scoping (scopeWhereCompany) is applied only in the list endpoint, not in show/update/destroy. Any authenticated user of one company can read, edit, or delete another company's notes by ID. This is a distinct finding from the previously reported CustomerPolicy company-ownership omission (a different policy class and controller). | Crater's NotePolicy checks only a blanket Bouncer ability (manage-all-notes / view-all-notes) with no company-ownership comparison, unlike InvoicePolicy and other sibling policies which additionally verify ->hasCompany(->company_id). Any authenticated user of one company can read, edit, or delete another company's notes by ID. |
Mon, 10 Aug 2026 11:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Title | Crater: Cross-Company IDOR on Notes via Missing Company-Ownership Check in NotePolicy | Crater - Cross-Company IDOR on Notes via Missing Company-Ownership Check in NotePolicy |
Fri, 07 Aug 2026 09:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Crater-invoice-inc
Crater-invoice-inc crater |
|
| Vendors & Products |
Crater-invoice-inc
Crater-invoice-inc crater |
Wed, 05 Aug 2026 14:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Wed, 05 Aug 2026 11:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Crater's NotePolicy checks only a blanket Bouncer ability (manage-all-notes / view-all-notes) with no company-ownership comparison, unlike InvoicePolicy and other sibling policies which additionally verify $user->hasCompany($model->company_id). NotesController's show(), update(), and destroy() actions authorize via $this->authorize('view notes'/'manage notes') without passing the target Note model, and Note's company-scoping (scopeWhereCompany) is applied only in the list endpoint, not in show/update/destroy. Any authenticated user of one company can read, edit, or delete another company's notes by ID. This is a distinct finding from the previously reported CustomerPolicy company-ownership omission (a different policy class and controller). | |
| Title | Crater: Cross-Company IDOR on Notes via Missing Company-Ownership Check in NotePolicy | |
| Weaknesses | CWE-639 | |
| References |
| |
| Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: TuranSec
Published: 2026-08-05T10:56:45.498Z
Updated: 2026-08-10T11:45:50.555Z
Reserved: 2026-08-05T10:53:53.176Z
Link: CVE-2026-71242
Vulnrichment
Updated: 2026-08-05T12:52:17.587Z
NVD
Status : Received
Published: 2026-08-05T11:16:27.123
Modified: 2026-08-10T12:17:26.747
Link: CVE-2026-71242
Redhat
No data.