Data Exposure Vulnerability in Crater by Crater Invoice

CVE-2026-55739

What is CVE-2026-55739?

The vulnerability in Crater Invoice permits authenticated users to access, reassign, or delete customer records belonging to other companies. The system's design isolates data by company_id; however, the Invoice, Estimate, Payment, and Expense policies do not enforce necessary ownership checks in their view, update, and delete methods. This oversight allows users to execute bulk deletion of customer data without proper authorization, posing a significant risk to customer information security. Specific methods related to customer management lack company-scoped filters, enabling harmful actions across distinct company accounts.

References