{"id":"CVE-2026-71242","summary":"Crater - Cross-Company IDOR on Notes via Missing Company-Ownership Check in NotePolicy","details":"Crater's NotePolicy checks only a blanket Bouncer ability (manage-all-notes / view-all-notes) with no company-ownership comparison, unlike InvoicePolicy and other sibling policies which additionally verify -\u003ehasCompany(-\u003ecompany_id). Any authenticated user of one company can read, edit, or delete another company's notes by ID.","modified":"2026-08-28T11:30:25.370142464Z","published":"2026-08-05T10:56:45.498Z","database_specific":{"cna_assigner":"TuranSec","cwe_ids":["CWE-639"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/71xxx/CVE-2026-71242.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/71xxx/CVE-2026-71242.json"},{"type":"ADVISORY","url":"https://github.com/crater-invoice/crater"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-71242"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/crater-invoice-inc/crater","events":[{"introduced":"18507ddb6f5881530ac78ba37b3d0b86c2e7e83f"},{"last_affected":"18507ddb6f5881530ac78ba37b3d0b86c2e7e83f"}],"database_specific":{"source":"AFFECTED_FIELD","extracted_events":[{"introduced":"6.0.6"},{"last_affected":"6.0.6"}]}}],"versions":["6.0.6"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-71242.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L"}]}