CVE-2026-71242 Crater: Cross-Company IDOR on Notes via Missing Company-Ownership Check in NotePolicy

Crater's NotePolicy checks only a blanket Bouncer ability manage-all-notes / view-all-notes with no company-ownership comparison, unlike InvoicePolicy and other sibling policies which additionally verify $user-hasCompany$model-companyid. NotesController's show, update, and destroy actions authori...

EUVD-2026-53315

Crater's NotePolicy checks only a blanket Bouncer ability manage-all-notes / view-all-notes with no company-ownership comparison, unlike InvoicePolicy and other sibling policies which additionally verify $user-hasCompany$model-companyid. NotesController's show, update, and destroy actions authori...

CVE-2025-4976

CVE-2025-4976 affects GitLab EE. Affected: all versions from 17.0 before 18.0.5, 18.1 before 18.1.3, and 18.2 before 18.2.1. Under certain circumstances, an attacker could access internal notes in GitLab Duo responses. Root cause details are not fully disclosed in the provided documents, but reme...