Crater isolates data by company_id and enforces authorization checks on Invoice, Estimate, Payment, and Expense entities using both a Bouncer ability check and a company ownership check. However, the CustomerPolicy's view, update, and delete methods omit the company ownership verification, performing only a blanket ability check. Additionally, route-model-bound customer lookups and the bulk Customer::deleteCustomers method use unscoped queries without filtering by company_id. This design flaw leads to an authorization bypass (CWE-639), allowing users with certain privileges to access or modify customer data belonging to other companies.

An attacker with limited privileges could bypass company ownership restrictions and view, update, or delete customer records belonging to other companies. This results in a high impact on confidentiality and integrity of customer data, with a low impact on availability. The CVSS 3.1 score is 8.2 (High), reflecting network attack vector, low complexity, low privileges required, no user interaction, and significant confidentiality and integrity impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user privileges carefully and monitor for unauthorized access attempts. Avoid using affected CustomerPolicy methods without additional company ownership checks in custom code.