CVE-2026-71242

Name of the Vulnerable Software and Affected Versions Crater (affected versions not specified)

Description An Insecure Direct Object Reference (IDOR) exists because the NotePolicy only verifies general Bouncer abilities (manage-all-notes or view-all-notes) without confirming if the user belongs to the company that owns the note. In the NotesController, the show(), update(), and destroy() actions perform authorization without passing the target Note model, and the scopeWhereCompany function is not applied to these actions. Consequently, an authenticated user from one company can read, edit, or delete notes belonging to another company by providing the note ID.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.