Crater-Invoice Crater
2 CVEs affecting Crater-Invoice Crater. Latest disclosed: 2026-08-05. Critical: 0, High: 2.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-71242 | High | 8.3 | 2026-08-05 | Crater's NotePolicy checks only a blanket Bouncer ability (manage-all-notes / view-all-notes) with no company-ownership comparison, unlike InvoicePolicy and ot… |
CVE-2026-55739 | High | 8.3 | 2026-08-05 | Crater isolates data per company_id, and its Invoice/Estimate/Payment/Expense policies enforce both a Bouncer ability check and ->hasCompany(->company_id). Cus… |