Authorization Flaw in Crater's NotePolicy Affects Company Note Management
CVE-2026-71242

8.2HIGH

Key Information:

Vendor

Crater-invoice

Status
Crater
Vendor
CVE Published:
5 August 2026

What is CVE-2026-71242?

The vulnerability in Crater's NotePolicy arises from inadequate authorization checks, allowing any authenticated user from one company to read, edit, or delete notes belonging to another company. Unlike InvoicePolicy, which correctly verifies company ownership, NotePolicy fails to implement similar checks in its show, update, and destroy actions, exposing sensitive notes to unauthorized access. This misconfiguration highlights a critical oversight in user permissions, necessitating immediate attention to secure the integrity of company-specific data.

Affected Version(s)

crater 6.0.6

References

https://github.com/crater-invoice/crater

CVSS V3.1

Score:
8.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Bobur Abdugafforov
.