Find a vulnerability

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "crater",
          "programFiles": [
            "app/Policies/NotePolicy.php",
            "app/Http/Controllers/V1/Admin/General/NotesController.php"
          ],
          "vendor": "crater-invoice",
          "versions": [
            {
              "status": "affected",
              "version": "6.0.6"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Bobur Abdugafforov"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Crater\u0027s NotePolicy checks only a blanket Bouncer ability (manage-all-notes / view-all-notes) with no company-ownership comparison, unlike InvoicePolicy and other sibling policies which additionally verify $user-\u003ehasCompany($model-\u003ecompany_id). NotesController\u0027s show(), update(), and destroy() actions authorize via $this-\u003eauthorize(\u0027view notes\u0027/\u0027manage notes\u0027) without passing the target Note model, and Note\u0027s company-scoping (scopeWhereCompany) is applied only in the list endpoint, not in show/update/destroy. Any authenticated user of one company can read, edit, or delete another company\u0027s notes by ID. This is a distinct finding from the previously reported CustomerPolicy company-ownership omission (a different policy class and controller)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639 Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T10:56:45.498Z",
        "orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
        "shortName": "TuranSec"
      },
      "references": [
        {
          "url": "https://github.com/crater-invoice/crater"
        }
      ],
      "title": "Crater: Cross-Company IDOR on Notes via Missing Company-Ownership Check in NotePolicy"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
    "assignerShortName": "TuranSec",
    "cveId": "CVE-2026-71242",
    "datePublished": "2026-08-05T10:56:45.498Z",
    "dateReserved": "2026-08-05T10:53:53.176Z",
    "dateUpdated": "2026-08-05T10:56:45.498Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Crater",
          "programFiles": [
            "app/Policies/CustomerPolicy.php",
            "app/Models/Customer.php"
          ],
          "vendor": "crater-invoice",
          "versions": [
            {
              "status": "affected",
              "version": "6.0.6"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Bobur Abdugafforov"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Crater isolates data per company_id, and its Invoice/Estimate/Payment/Expense policies enforce both a Bouncer ability check and $user-\u003ehasCompany($model-\u003ecompany_id). CustomerPolicy\u0027s view/update/delete methods omit the company-ownership check entirely, checking only the blanket ability. Route-model-bound customer lookups and the bulk Customer::deleteCustomers() method are similarly unscoped (self::find($id) with no company filter). Any authenticated user of one company can read, reassign (steal), or delete another company\u0027s customer records, with deletion cascading to that customer\u0027s invoices and payments."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "value": "HIGH"
            },
            "type": "CVSS_3.1_severity"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639 Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T06:58:38.155Z",
        "orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
        "shortName": "TuranSec"
      },
      "references": [
        {
          "url": "https://github.com/crater-invoice/crater"
        }
      ],
      "title": "Crater: Missing Tenant-Ownership Check in CustomerPolicy Allows Cross-Company Customer Data Theft and Deletion"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
    "assignerShortName": "TuranSec",
    "cveId": "CVE-2026-55739",
    "datePublished": "2026-08-05T06:58:38.155Z",
    "dateReserved": "2026-06-17T12:59:17.620Z",
    "dateUpdated": "2026-08-05T06:58:38.155Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}