CVE-2026-55739

Received Received - Intake

Customer Data Exposure in Crater Invoicing Software

Publication date: 2026-08-05

Last updated on: 2026-08-10

Assigner: TuranSec

Description

Crater isolates data per company_id, and its Invoice/Estimate/Payment/Expense policies enforce both a Bouncer ability check and ->hasCompany(->company_id). CustomerPolicy's view/update/delete methods omit the company-ownership check entirely, checking only the blanket ability. Route-model-bound customer lookups and the bulk Customer::deleteCustomers method are similarly unscoped (self::find with no company filter).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-05

Last Modified

2026-08-10

Generated

2026-08-25

AI Q&A

2026-08-05

EPSS Evaluated

2026-08-24

NVD

CVE-2026-55739

EUVD

EUVD-2026-53194

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

This vulnerability allows authenticated users to access, modify, or delete customer records belonging to other companies within the same system. The issue stems from missing company-specific ownership checks in customer-related policies and methods, enabling unauthorized data access and manipulation across company boundaries.

Detection Guidance

This vulnerability involves improper access control in Crater's customer data handling. To detect it, review application logs for unauthorized customer record access, modification, or deletion attempts across different company IDs. Check for queries using self::find($id) without company_id filters in customer-related endpoints. Inspect bulk delete operations for Customer::deleteCustomers() calls lacking company scoping.

Impact Analysis

An attacker could steal, reassign, or delete customer data from other companies, leading to data breaches, financial loss, or reputational damage. Deletion cascades could also remove related invoices and payments, disrupting business operations.

Compliance Impact

This vulnerability likely violates data protection regulations such as GDPR and HIPAA by enabling unauthorized access to sensitive customer data across company boundaries, risking non-compliance with privacy and security requirements.

Mitigation Strategies

Review and update CustomerPolicy to enforce company-ownership checks in view/update/delete methods. Ensure all customer lookups and bulk operations apply company_id filters. Validate that Bouncer ability checks and hasCompany() calls are consistently applied across all related routes and methods.

Hi! I’m here to help you understand CVE-2026-55739. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70