Threats tagged 'ghsa-2467-45mc-2xp5'

1 threat

Severity	CVSS	Signals	Threat	Source	Published	Score and star
High	8.2	EPSS 0.4%	CVE-2026-71242crater · Insecure Direct Object Reference High8.2EPSS 0.4%2026-08-05CVE Database V5CVE-2026-71242 Crater's NotePolicy checks only a blanket Bouncer ability (manage-all-notes / view-all-notes) with no company-ownership comparison, unlike InvoicePolicy and other sibling policies which additionally verify ->hasCompany(->company_id). Any authenticated user of one company can read, edit, or delete another company's notes by ID. EPSS 0.4%Vulnerability crater-invoice CWE-639 #ghsa-2467-45mc-2xp5	CVE Database V5	2026-08-05

Page 1 of 1