CVE-2026-55739 affects Crater, an open-source invoicing application, which isolates data by company_id. While Invoice, Estimate, Payment, and Expense policies correctly enforce both a Bouncer ability check and a company ownership verification, the CustomerPolicy is missing the company-ownership check for view, update, and delete operations. Route-model-bound customer lookups and the bulk Customer::deleteCustomers() method use unscoped queries (self::find($id)) without filtering by company. As a result, any authenticated user belonging to one company can read, reassign, or delete customer records belonging to any other company. Deletion cascades to the affected customer's invoices and payments, amplifying the impact. This constitutes an Insecure Direct Object Reference (IDOR) / broken object-level authorization vulnerability. The issue is tracked publicly on the Crater GitHub repository.