Crater isolates data per company_id, ensuring that invoices, estimates, payments, and expenses are scoped to a tenant. However, the CustomerPolicy view, update, and delete methods do not perform the necessary company‑ownership validation; they only check for a generic Bouncer permission. Likewise, route‑model bound lookups and bulk deletion ignore any company filter, using a plain find call. As a result, any authenticated user with a broad permission can read, modify, or permanently delete customers belonging to other companies, causing unauthorized disclosure, tampering, and potential cascading deletions of related financial records. This flaw undermines tenant isolation and data integrity.

This flaw exists in the Crater invoice management software from crater‑invoice. All versions lacking the security fix are vulnerable; no specific version range is listed, so organizations should assume the default installation is impacted until an update is applied.

The CVSS score of 8.2 indicates high severity, and the EPSS score of 0.00265 (approximately 0.265%) shows a very low overall probability of exploitation. Nevertheless, because the flaw can be leveraged by any authenticated user with a broad permission within a tenant, the attack requires only minimal effort once credentials are available. The vulnerability is not listed in the CISA KEV catalog and no publicly known exploits are cited, but the combination of internal access and lack of tenant scoping presents a significant risk to organizational data and mandates prompt remediation.