The vulnerability arises from crater's NotePolicy implementation, which checks only a blanket Bouncer ability (manage-all-notes / view-all-notes) without performing a company ownership check (->hasCompany(->company_id)) as done in other policies like InvoicePolicy. This allows any authenticated user from one company to read, edit, or delete notes of another company by specifying the note ID, resulting in an authorization bypass (CWE-639). The CVSS 3.1 score is 8.2, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impact with low availability impact.

An attacker with authenticated access to the crater application can bypass intended authorization controls to access, modify, or delete notes belonging to other companies. This compromises confidentiality and integrity of sensitive note data across company boundaries, potentially leading to data leakage or unauthorized data manipulation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected version 6.0.6 and monitor for unauthorized note access. Avoid sharing credentials across companies and apply strict access controls at the application level if possible.