CVE-2026-51956

Name of the Vulnerable Software and Affected Versions Grashjs Atlas CMMS versions prior to 1.6.0

Description A Broken Object Level Authorization issue allows an authenticated user from one tenant to read and modify the company record of another tenant. This occurs because the application fails to enforce tenant-level ownership checks when accessing or updating company objects. An attacker can achieve this by modifying the numeric id variable in the '/company/{id}' endpoint, enabling unauthorized cross-tenant access and modification of company profile data.

Recommendations Update Grashjs Atlas CMMS to version 1.6.0 or later. Restrict access to the '/company/{id}' endpoint to ensure users can only access records belonging to their own tenant.