CVE-2026-71242

8.3 HIGHpublic exploit available

Published 2026-08-05 · Updated 2026-08-10

AI risk analysis

Summary: The flaw allows any authenticated user to manipulate notes from another company due to missing company-ownership verification, posing a significant security risk.
Exploitability: Exploitation is relatively easy as it requires only an authenticated session, making it a high-risk vulnerability.
Blast radius: If exploited, this could lead to data breaches, unauthorized modifications, and potential legal ramifications for the affected companies.
Detection: No reliable host or network indicator is derivable from the published description.
Prioritized remediation: Upgrade to the fixed version 2.590 or later.

auth-bypasswebdata-mismanagement

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

Crater's NotePolicy checks only a blanket Bouncer ability (manage-all-notes / view-all-notes) with no company-ownership comparison, unlike InvoicePolicy and other sibling policies which additionally verify ->hasCompany(->company_id). Any authenticated user of one company can read, edit, or delete another company's notes by ID.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

Weaknesses

CWE-639

Public exploit & PoC references

https://github.com/crater-invoice/crater

References

https://github.com/crater-invoice/crater

Data: NVD (public domain). Analysis: local $0 model. Defensive use only.