The vulnerability in crater-invoice crater version 6.0.6 involves improper authorization checks in the NotePolicy. Unlike InvoicePolicy and other sibling policies that verify if a user belongs to the company owning the resource, NotePolicy only checks for broad Bouncer abilities (manage-all-notes/view-all-notes) without company ownership validation. Additionally, NotesController's show(), update(), and destroy() methods authorize actions without passing the specific Note model, and company scoping is only enforced in the list endpoint. This allows any authenticated user from one company to access, modify, or delete notes of another company by specifying the note ID, constituting an authorization bypass (CWE-639).

An authenticated user from one company can access, modify, or delete notes belonging to another company, potentially exposing sensitive information and allowing unauthorized data manipulation. This compromises confidentiality, integrity, and partially availability of note data across companies using the affected version.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected version 6.0.6 and consider implementing additional access controls or monitoring for unauthorized note access. Avoid exposing note IDs to untrusted users.