Yüksek CVSS 8.3
CVE-2026-55739: CVE-2026-55739: güvenlik açığı
Açıklama (NVD)
Crater isolates data per company_id, and its Invoice/Estimate/Payment/Expense policies enforce both a Bouncer ability check and ->hasCompany(->company_id). CustomerPolicy's view/update/delete methods omit the company-ownership check entirely, checking only the blanket ability. Route-model-bound customer lookups and the bulk Customer::deleteCustomers method are similarly unscoped (self::find with no company filter).
Özet bilgiler
- CVSS v3.1
- 8.3
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L - EPSS
- %0,37 (yüzdelik 32)
- CWE
- CWE-639
- Yama
- Yok / bilinmiyor