CyberRota Analysis
AI-GeneratedThe vulnerability allows any authenticated user from one company to read, edit, or delete notes belonging to another company due to insufficient authorization checks in the NotesController's actions. This oversight stems from the lack of company-ownership verification in the NotePolicy, which only checks blanket permissions rather than specific ownership. Organizations using Crater's NotePolicy should prioritize addressing this issue to prevent unauthorized access and potential data breaches.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Crater's NotePolicy checks only a blanket Bouncer ability (manage-all-notes / view-all-notes) with no company-ownership comparison, unlike InvoicePolicy and other sibling policies which additionally verify ->hasCompany(->company_id). Any authenticated user of one company can read, edit, or delete another company's notes by ID.