CVE-2026-55739 — Crater - Missing Tenant-Ownership Check in CustomerPolicy Allows Cross-Company Customer Data Theft and Deletion

CVE-2026-55739

Crater - Missing Tenant-Ownership Check in CustomerPolicy Allows Cross-Company Customer Data Theft and Deletion PUBLISHED

Description (CNA)

Crater isolates data per company_id, and its Invoice/Estimate/Payment/Expense policies enforce both a Bouncer ability check and ->hasCompany(->company_id). CustomerPolicy's view/update/delete methods omit the company-ownership check entirely, checking only the blanket ability. Route-model-bound customer lookups and the bulk Customer::deleteCustomers method are similarly unscoped (self::find with no company filter).

Affected (CNA)

Vendor / product	Versions
crater-invoice / Crater	affected 6.0.6

CWE

CWE-639

References

https://github.com/crater-invoice/crater

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.