High severity8.3NVD Advisory· Published Aug 5, 2026· Updated Aug 26, 2026
CVE-2026-71242
CVE-2026-71242
Description
Crater's NotePolicy checks only a blanket Bouncer ability (manage-all-notes / view-all-notes) with no company-ownership comparison, unlike InvoicePolicy and other sibling policies which additionally verify ->hasCompany(->company_id). Any authenticated user of one company can read, edit, or delete another company's notes by ID.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1Patches
Vulnerability mechanics
News mentions
0No linked articles in our index yet.