CVE-2026-51956: Grashjs Atlas CMMS vulnerability
A Broken Object Level Authorization vulnerability exists in Grashjs Atlas CMMS prior to v1.6.0. An authenticated user from one tenant can read and modify another tenant's company record by changing only the numeric ID in the /company/{id} endpoint. The application does not enforce tenant-level ownership checks when accessing or updating company objects, allowing cross-tenant access and modification of company profile data.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Grashjs Atlas CMMSto a version that resolves this vulnerability.Fixed in v1.6.0 - Compensating control
Restrict access to the /company/{id} endpoint so authenticated users can only access company records that belong to their own tenant (enforce tenant-level ownership checks for reads and updates).
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated Atlas CMMS user from one tenant can exploit it. The attacker only needs to alter the numeric company ID in the /company/{id} endpoint request.
What data and actions are exposed?
An attacker can read and modify company profile records belonging to other tenants. The issue affects both access and update operations because tenant ownership is not checked for company objects.
Are installations running v1.6.0 affected?
The vulnerability affects versions prior to v1.6.0. Based on the available information, v1.6.0 is not within the stated affected version range.