CVE-2026-71242 — Crater - Cross-Company IDOR on Notes via Missing Company-Ownership Check in NotePolicy
Crater's NotePolicy checks only a blanket Bouncer ability (manage-all-notes / view-all-notes) with no company-ownership comparison, unlike InvoicePolicy and other sibling polici…
Published: 2026-08-05 · CVSS: 8.2 · CVSS 3.1
Crater's NotePolicy checks only a blanket Bouncer ability (manage-all-notes / view-all-notes) with no company-ownership comparison, unlike InvoicePolicy and other sibling policies which additionally verify ->hasCompany(->company_id). Any authenticated user of one company can read, edit, or delete another company's notes by ID.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7