AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-05T11:16:27.123Z and has not been modified since then. Crater's NotePolicy checks only a blanket Bouncer ability (manage-all-notes / view-all-notes) with no company-ownership comparison, unlike InvoicePolicy and other sibling policies which additionally verify $user->hasCompany($model->company_id). [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-05T08:16:33.903Z and has not been modified since then. Crater's CustomerPolicy omits company-ownership checks, allowing authenticated users of one company to read, reassign, or delete another company's customer records. This vulnerability exists due to the lack of proper access controls in the Custo [truncated]
