{"id":"CVE-2026-55739","summary":"Crater - Missing Tenant-Ownership Check in CustomerPolicy Allows Cross-Company Customer Data Theft and Deletion","details":"Crater isolates data per company_id, and its Invoice/Estimate/Payment/Expense policies enforce both a Bouncer ability check and -\u003ehasCompany(-\u003ecompany_id). CustomerPolicy's view/update/delete methods omit the company-ownership check entirely, checking only the blanket ability. Route-model-bound customer lookups and the bulk Customer::deleteCustomers method are similarly unscoped (self::find with no company filter).","modified":"2026-08-12T03:51:44.962459158Z","published":"2026-08-05T06:58:38.155Z","database_specific":{"cwe_ids":["CWE-639"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55739.json","cna_assigner":"TuranSec"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55739.json"},{"type":"ADVISORY","url":"https://github.com/crater-invoice/crater"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55739"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/crater-invoice-inc/crater","events":[{"introduced":"18507ddb6f5881530ac78ba37b3d0b86c2e7e83f"},{"last_affected":"18507ddb6f5881530ac78ba37b3d0b86c2e7e83f"}],"database_specific":{"extracted_events":[{"introduced":"6.0.6"},{"last_affected":"6.0.6"}],"source":"AFFECTED_FIELD"}}],"versions":["6.0.6"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55739.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L"}]}