CVE-2026-71242
HighCVSS 8.3Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
Crater's NotePolicy checks only a blanket Bouncer ability (manage-all-notes / view-all-notes) with no company-ownership comparison, unlike InvoicePolicy and other sibling policies which additionally verify ->hasCompany(->company_id). Any authenticated user of one company can read, edit, or delete another company's notes by ID.
Risk Assessment
Authenticated users can access confidential notes of other companies, breaking data isolation between companies and potentially leading to information leakage.
Recommendation
Update Crater to a version that implements company ownership checks in NotePolicy, or temporarily restrict access to notes through additional application-level controls.
Other vulnerabilities in Crater
Original NVD description (English source)
Crater's NotePolicy checks only a blanket Bouncer ability (manage-all-notes / view-all-notes) with no company-ownership comparison, unlike InvoicePolicy and other sibling policies which additionally verify ->hasCompany(->company_id). Any authenticated user of one company can read, edit, or delete another company's notes by ID.