Crater isolates data by company_id and enforces authorization checks on Invoice, Estimate, Payment, and Expense entities by verifying both a Bouncer ability and company ownership via $user->hasCompany($model->company_id). However, the CustomerPolicy's view, update, and delete methods omit the company ownership check, relying solely on a blanket ability check. Additionally, customer lookups via route-model binding and the bulk Customer::deleteCustomers() method use unscoped queries (self::find($id)) without filtering by company_id. As a result, any authenticated user from one company can read, reassign, or delete customer records of another company, with deletions cascading to associated invoices and payments. This constitutes an authorization bypass (CWE-639).

An attacker with authenticated access to Crater can bypass authorization controls to access, modify, or delete customer data belonging to other companies. This leads to confidentiality breaches (unauthorized data access), integrity violations (reassignment of customer records), and availability impacts (deletion of customers and cascading deletion of invoices and payments). The CVSS score of 8.2 reflects high impact with network attack vector, low attack complexity, and requiring low privileges but no user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to trusted users only and monitor for suspicious activity related to customer data access. Avoid using version 6.0.6 in production environments if possible.