Approved changes feed: RSS · Atom
cpe:2.3:a:crater-invoice:crater:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Crater Invoice (4e516279-961e-5b2d-81ad-c43dac16452f) |
|---|---|
| Product | Crater (ed1592a6-a688-5b6e-8eb6-e662f3874a89) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-55739 |
vulnerable | 2026-09-16 04:33:13.021854 |
Crater - Missing Tenant-Ownership Check in CustomerPolicy Allows Cross-Company Customer Data Theft and Deletion
HIGH (8.2)
Crater isolates data per company_id, and its Invoice/Estimate/Payment/Expense policies enforce both a Bouncer ability check and ->hasCompany(->company_id). CustomerPolicy's view/update/delete methods omit the company-ownership check entirely, checking only the blanket ability. Route-model-bound customer lookups and the bulk Customer::deleteCustomers method are similarly unscoped (self::find with no company filter).
Published: 2026-08-05T06:58:38.155Z
Updated: 2026-08-10T11:44:16.897Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-71242 |
vulnerable | 2026-09-16 04:32:59.678355 |
Crater - Cross-Company IDOR on Notes via Missing Company-Ownership Check in NotePolicy
HIGH (8.2)
Crater's NotePolicy checks only a blanket Bouncer ability (manage-all-notes / view-all-notes) with no company-ownership comparison, unlike InvoicePolicy and other sibling policies which additionally verify ->hasCompany(->company_id). Any authenticated user of one company can read, edit, or delete another company's notes by ID.
Published: 2026-08-05T10:56:45.498Z
Updated: 2026-08-10T11:45:50.555Z Reference links |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.