CVE-2026-55739
Received Received - Intake

Customer Data Exposure in Crater Invoicing Software

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

Description
Crater isolates data per company_id, and its Invoice/Estimate/Payment/Expense policies enforce both a Bouncer ability check and $user->hasCompany($model->company_id). CustomerPolicy's view/update/delete methods omit the company-ownership check entirely, checking only the blanket ability. Route-model-bound customer lookups and the bulk Customer::deleteCustomers() method are similarly unscoped (self::find($id) with no company filter). Any authenticated user of one company can read, reassign (steal), or delete another company's customer records, with deletion cascading to that customer's invoices and payments.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-05
Last Modified
2026-08-05
Generated
2026-08-05
AI Q&A
2026-08-05
EPSS Evaluated
N/A
NVD
CVE-2026-55739
EUVD
EUVD-2026-53194

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability allows authenticated users to access, modify, or delete customer records belonging to other companies within the same system. The issue stems from missing company-specific ownership checks in customer-related policies and methods, enabling unauthorized data access and manipulation across company boundaries.

Impact Analysis

An attacker could steal, reassign, or delete customer data from other companies, leading to data breaches, financial loss, or reputational damage. Deletion cascades could also remove related invoices and payments, disrupting business operations.

Compliance Impact

This vulnerability likely violates data protection regulations such as GDPR and HIPAA by enabling unauthorized access to sensitive customer data across company boundaries, risking non-compliance with privacy and security requirements.

Mitigation Strategies

Review and update CustomerPolicy to enforce company-ownership checks in view/update/delete methods. Ensure all customer lookups and bulk operations apply company_id filters. Validate that Bouncer ability checks and hasCompany() calls are consistently applied across all related routes and methods.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-55739. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart