CVE-2026-55739

HighCVSS 8.3

Published: 05/08/2026(UTC)Updated: 28/08/2026(UTC)Translated: 10/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.27%

18th percentile - higher than 18% of all known CVEs

Summary

Crater isolates data per company_id, but CustomerPolicy's view/update/delete methods omit the company-ownership check, and route-model-bound customer lookups and bulk delete are unscoped, allowing cross-company access.

Risk Assessment

An attacker can access or modify customer data of other companies, leading to confidentiality and integrity breaches.

Recommendation

Add company ownership checks in CustomerPolicy methods and bulk operations, and scope customer lookups to the current company.

Other vulnerabilities in Crater

CVE-2026-71242High
Crater's NotePolicy checks only a blanket Bouncer ability (manage-all-notes / view-all-notes) with no company-ownership comparison, unlike InvoicePolicy and other sibling policies which additionally verify ->hasCompany(->company_id). Any authenticated user of one company can read, edit, or delete another company's notes by ID.

Original NVD description (English source)

Crater isolates data per company_id, and its Invoice/Estimate/Payment/Expense policies enforce both a Bouncer ability check and ->hasCompany(->company_id). CustomerPolicy's view/update/delete methods omit the company-ownership check entirely, checking only the blanket ability. Route-model-bound customer lookups and the bulk Customer::deleteCustomers method are similarly unscoped (self::find with no company filter).