CVE-2026-55739

Crater - Missing Tenant-Ownership Check in CustomerPolicy Allows Cross-Company Customer Data Theft and Deletion

Published Aug 5, 2026 CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Description

Crater isolates data per company_id, and its Invoice/Estimate/Payment/Expense policies enforce both a Bouncer ability check and ->hasCompany(->company_id). CustomerPolicy's view/update/delete methods omit the company-ownership check entirely, checking only the blanket ability. Route-model-bound customer lookups and the bulk Customer::deleteCustomers method are similarly unscoped (self::find with no company filter).

Analysis

Technical impact

Crater isolates data per company_id, ensuring that invoices, estimates, payments, and expenses are scoped to a tenant. However, the CustomerPolicy view, update, and delete methods do not perform the necessary company‑ownership validation; they only check for a generic Bouncer permission. Likewise, route‑model bound lookups and bulk deletion ignore any company filter, using a plain find call. As a result, any authenticated user with a broad permission can read, modify, or permanently delete customers belonging to other companies, causing unauthorized disclosure, tampering, and potential cascading deletions of related financial records. This flaw undermines tenant isolation and data integrity.

Affected Systems

This flaw exists in the Crater invoice management software from crater‑invoice. All versions lacking the security fix are vulnerable; no specific version range is listed, so organizations should assume the default installation is impacted until an update is applied.

Risk and Exploitability

The CVSS score of 8.2 indicates high severity, and the EPSS score of 0.00265 (approximately 0.265%) shows a very low overall probability of exploitation. Nevertheless, because the flaw can be leveraged by any authenticated user with a broad permission within a tenant, the attack requires only minimal effort once credentials are available. The vulnerability is not listed in the CISA KEV catalog and no publicly known exploits are cited, but the combination of internal access and lack of tenant scoping presents a significant risk to organizational data and mandates prompt remediation.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

crater-invoice

Crater

unknown

Version	Status	Constraints
`6.0.6`	affected	—

No data.

Vendor Product Versions

Crater-invoice-inc

Crater

Version	Status	Scheme	Platform
`6.0.6`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Deploy the latest patch from Crater that adds a company‑ownership check to CustomerPolicy; obtain the update from the official repository or vendor portal.
If a patch is not yet available, implement a temporary rule in the application to enforce a company id comparison whenever a customer record is accessed, updated, or deleted.
Restrict roles that have blanket Bouncer permissions across tenants; apply least privilege by limiting such global abilities to a minimal administrative group.
Enable monitoring and logging for all customer‑record operations to detect anomalous cross‑tenant activity and alert security teams promptly.

Generated by OpenCVE AI on August 10, 2026 at 23:02 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.374% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://github.com/crater-invoice/crater

History

Aug 10, 2026 12:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Aug 10, 2026 12:00 PM Description updated View changes

Type	Values Removed	Values Added
Description	Crater isolates data per company_id, and its Invoice/Estimate/Payment/Expense policies enforce both a Bouncer ability check and $user->hasCompany($model->company_id). CustomerPolicy's view/update/delete methods omit the company-ownership check entirely, checking only the blanket ability. Route-model-bound customer lookups and the bulk Customer::deleteCustomers() method are similarly unscoped (self::find($id) with no company filter). Any authenticated user of one company can read, reassign (steal), or delete another company's customer records, with deletion cascading to that customer's invoices and payments.	Crater isolates data per company_id, and its Invoice/Estimate/Payment/Expense policies enforce both a Bouncer ability check and ->hasCompany(->company_id). CustomerPolicy's view/update/delete methods omit the company-ownership check entirely, checking only the blanket ability. Route-model-bound customer lookups and the bulk Customer::deleteCustomers method are similarly unscoped (self::find with no company filter).

Aug 10, 2026 11:30 AM Title updated View changes

Type	Values Removed	Values Added
Title	Crater: Missing Tenant-Ownership Check in CustomerPolicy Allows Cross-Company Customer Data Theft and Deletion	Crater - Missing Tenant-Ownership Check in CustomerPolicy Allows Cross-Company Customer Data Theft and Deletion

Aug 5, 2026 9:45 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Crater-invoice-inc Crater-invoice-inc crater
Vendors & Products		Crater-invoice-inc Crater-invoice-inc crater

Aug 5, 2026 7:30 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Crater isolates data per company_id, and its Invoice/Estimate/Payment/Expense policies enforce both a Bouncer ability check and $user->hasCompany($model->company_id). CustomerPolicy's view/update/delete methods omit the company-ownership check entirely, checking only the blanket ability. Route-model-bound customer lookups and the bulk Customer::deleteCustomers() method are similarly unscoped (self::find($id) with no company filter). Any authenticated user of one company can read, reassign (steal), or delete another company's customer records, with deletion cascading to that customer's invoices and payments.
Title		Crater: Missing Tenant-Ownership Check in CustomerPolicy Allows Cross-Company Customer Data Theft and Deletion
Weaknesses		CWE-639
References		https://github.com/crater-invoice/crater
Metrics		cvssV3_1 `{'score': 8.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L'}`