CVE-2026-71242

Crater vulnerability CVE-2026-71242 exposes cross-company IDOR in notes. The NotePolicy uses a blanket manage/view notes check without company ownership verification, unlike other policies that call hasCompany(model->company_id). NotesController actions (show, update, destroy) authorize withou...