Crater's NotePolicy does not enforce company‑ownership when authorizing note operations. The policy only checks for a blanket Bouncer ability, and the controller actions do not pass the target Note to the authorize call. Because of this, any authenticated user can read, edit, or delete notes of other companies by supplying a note ID. This is an IDOR (CWE‑639) that compromises confidentiality and integrity of sensitive data stored in the notes.

The vulnerability impacts the open‑source invoicing application Crater from the vendor crater‑invoice. No specific release or version is identified in the advisory, so any current or future versions that retain the described policy logic may be affected until the fix is applied.

The CVSS score of 8.2 classifies it as High severity, and while an EPSS score is not provided, the vulnerability is straightforward to exploit by an authenticated user. Based on the description, it is inferred that the attack vector is through the web interface or API endpoints for show, update, and destroy actions, requiring only a valid user session. There is no indication of denial of service or remote code execution, but unauthorized access to other organizations' notes carries significant privacy and data integrity risks.