CVE-2026-51956

Grashjs Atlas CMMS versions prior to 1.6.0 do not enforce tenant-level ownership checks when accessing or updating company records, a broken object level authorization flaw (CWE-284). Any authenticated user can change only the numeric ID in the /company/{id} endpoint path to reference another tenant's company record and both read and modify it, because access and updates are not scoped to the user's own tenant. An attacker gains unauthorized visibility into and control over other tenants' company profile data, yielding cross-tenant confidentiality and integrity impact but no availability impact, consistent with the CVSS 3.1 score of 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). Only organizations running multi-tenant deployments of Atlas CMMS on versions before 1.6.0 are exposed, and exploitation requires valid low-privileged credentials in at least one tenant. There is no public proof-of-concept, the flaw is not in CISA KEV, and EPSS estimates only a 0.2% probability of exploitation in the next 30 days, so no in-the-wild exploitation is currently known.

What to do: Upgrade Atlas CMMS to v1.6.0 or later, which introduces tenant ownership enforcement on company object access. If upgrading is not immediately possible, restrict and monitor /company/{id} requests and review access logs for authenticated users probing company IDs outside their own tenant. Multi-tenant operators should also audit whether company records were read or modified across tenant boundaries before the upgrade.