CVE-2026-55739

Crater isolates data per company_id, and its Invoice/Estimate/Payment/Expense policies enforce both a Bouncer ability check and ->hasCompany(->company_id). CustomerPolicy's view/update/delete methods omit the company-ownership check entirely, checking only the blanket ability. Route-model-bound customer lookups and the bulk Customer::deleteCustomers method are similarly unscoped (self::find with no company filter).

• CWE-639

• https://github.com/crater-invoice/crater

Published

Aug 5, 2026

Last Modified

Aug 10, 2026

Status

Received

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-55733Allocation of Resources Without Limits or Throttling in uebe…7.5
• CVE-2026-55734Allocation of Resources Without Limits or Throttling vulnera…7.5
• CVE-2026-55735Improper Verification of Cryptographic Signature in ueberaut…7.5
• CVE-2026-55736Improperly Controlled Modification of Dynamically-Determined…5.9
• CVE-2026-55737Signed to Unsigned Conversion Error and Out-of-bounds Write …7.5
• CVE-2026-55738A stack-based buffer overflow exists in the raw_to_header fu…8.8
• CVE-2026-5574A security vulnerability has been detected in Technostrobe H…9.1
• CVE-2026-55740Nur-Alam39 bus-ticket (no released versions; latest commit 4…9.8
• CVE-2026-55741Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable…8.8
• CVE-2026-55742Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable…9.6
• CVE-2026-55743The shell tool command allowlist in the SecurityPolicy of Op…9.6
• CVE-2026-55744Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable…8.6