Crater version 6.0.6 is vulnerable to an authorization bypass that allows authenticated users to access data belonging to other companies due to insufficient policy enforcement.

This is an authorization bypass flaw caused by a failure to correctly validate the company identifier against the user session. It requires the attacker to be an authenticated user within the system to perform unauthorized actions on models like invoices, estimates, or expenses.

Successful exploitation allows a user to access, modify, or delete sensitive financial records belonging to other companies within a multi-tenant environment. Given the CVSS score of 8.2, the impact on business confidentiality and integrity is severe, as it undermines the core multi-tenancy isolation of the application and risks the exposure of financial data.

Immediate Action: Check the vendor's repository for the latest security release and apply it immediately to resolve the policy enforcement failure.

Proactive Monitoring: Audit database logs and application access patterns to identify any instances where users have accessed records associated with unauthorized company identifiers.

Compensating Controls: Deploy a Web Application Firewall (WAF) to monitor for anomalous parameter manipulation in requests involving company-specific IDs.

Public Exploit Available: Unknown

Organizations using Crater version 6.0.6 must treat this as a high-priority security issue. Because this vulnerability involves a bypass of core data isolation, it is imperative to monitor for official vendor patches and apply them as soon as they become available to ensure the integrity of multi-tenant data.