Crater's NotePolicy verifies only a blanket Bouncer ability (manage-all-notes or view-all-notes) and does not compare the company ownership of notes. The policy thus lacks a check like ->hasCompany(->company_id). Because of this, any authenticated user from one company can read, edit, or delete another company's notes by ID. This is an IDOR (CWE‑639) that compromises the confidentiality and integrity of the notes.

The vulnerability impacts the open‑source invoicing application Crater from the vendor crater‑invoice. No specific release or version is identified in the advisory, so any current or future versions that retain the described policy logic may be affected until the fix is applied.

The CVSS score of 8.2 classifies it as High severity, and the EPSS score of 0.00215 (less than 1%) indicates a low yet non‑zero likelihood of exploitation. Based on the description, it is inferred that the attack vector is through the web interface or API endpoints for show, update, and destroy actions, requiring only a valid user session. There is no indication of denial of service or remote code execution, but unauthorized access to other organizations' notes carries significant privacy and data integrity risks.