CVE-2026-71242 crater-invoice CVE debrief

Who should care

Administrators and users of Crater installations, security teams responsible for monitoring and protecting against unauthorized access, and developers working on authorization and access control features in Crater should be aware of this vulnerability. They should review and update the NotesController's authorization logic and NotePolicy to prevent unauthorized access to notes across different companies.

Technical summary

The NotesController in Crater fails to properly authorize access to notes based on company ownership. Specifically, the NotePolicy only checks for blanket Bouncer abilities (manage-all-notes / view-all-notes) without verifying company ownership. This allows any authenticated user of one company to read, edit, or delete notes of another company by ID. The issue arises from the lack of company-ownership comparison in the authorization logic of NotesController's show(), update(), and destroy() actions. To address this, defenders should focus on updating the authorization logic and implementing additional access controls.

Defensive priority

Authenticated users of one company can read, edit, or delete notes of another company by ID due to inadequate authorization checks in NotesController.

Recommended defensive actions

• Review and update NotesController's authorization logic to include company-ownership checks
• Implement additional access controls to restrict note access based on company ownership
• Verify and update NotePolicy to align with other sibling policies
• Conduct thorough testing of NotesController actions to ensure proper authorization
• Consider implementing compensating controls to monitor and detect unauthorized access
• Review relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE description indicates that Crater's NotePolicy lacks company-ownership comparison, unlike other sibling policies. This leads to unauthorized access to notes across different companies. The NotesController's show(), update(), and destroy() actions authorize via $this->authorize('view notes'/'manage notes') without passing the target Note model, allowing any authenticated user of one company to read, edit, or delete another company's notes by ID. The issue arises from the lack of company-ownership comparison in the authorization logic. To verify, defenders should review the NotesController actions and NotePolicy logic.

Official resources