HIGH
CVE-2026-71242
CVSS
8.3
Description
Crater's NotePolicy checks only a blanket Bouncer ability (manage-all-notes / view-all-notes) with no company-ownership comparison, unlike InvoicePolicy and other sibling policies which additionally verify ->hasCompany(->company_id). Any authenticated user of one company can read, edit, or delete another company's notes by ID.
Weakness (CWE)
CWE-639
Authorization Bypass (IDOR)
EPSS Score
0.22%
Probability of exploitation in next 30 days
12.2th percentile
References
Base CVE data derived from NVD (public domain). Enrichment by
dbcve.org
(CC-BY-4.0). Fetched via API.