CyberRota Analysis
AI-GeneratedThe vulnerability allows authenticated users from one company to access, reassign, or delete customer records belonging to another company due to inadequate company-ownership checks in the CustomerPolicy methods and related functions. This can lead to unauthorized data exposure and potential data loss, as deletions cascade to associated invoices and payments. Organizations utilizing the affected product should prioritize addressing this issue to protect sensitive customer data and maintain compliance with data protection regulations.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Crater isolates data per company_id, and its Invoice/Estimate/Payment/Expense policies enforce both a Bouncer ability check and ->hasCompany(->company_id). CustomerPolicy's view/update/delete methods omit the company-ownership check entirely, checking only the blanket ability. Route-model-bound customer lookups and the bulk Customer::deleteCustomers method are similarly unscoped (self::find with no company filter).