What’s Vulnerable › Vulnerabilities

CVE-2026-71242: Crater - Cross-Company IDOR on Notes via Missing Company-Ownership Check in NotePolicy

• Severity: high (CVSS 8.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-05 · updated 2026-10-24
• Weakness: CWE-639

Description

Crater's NotePolicy checks only a blanket Bouncer ability (manage-all-notes / view-all-notes) with no company-ownership comparison, unlike InvoicePolicy and other sibling policies which additionally verify ->hasCompany(->company_id). Any authenticated user of one company can read, edit, or delete another company's notes by ID.

Affected products

• crater-invoice/crater: 6.0.6

References

• https://github.com/crater-invoice/crater

Get alerted when CVE-2026-71242 or the next vulnerability affects your stack