CyberRota Analysis
AI-GeneratedGrashjs Atlas CMMS versions prior to 1.6.0 are vulnerable to a Broken Object Level Authorization issue, allowing authenticated users from one tenant to access and modify company records of another tenant by simply altering the numeric ID in the /company/{id} endpoint. This lack of tenant-level ownership checks poses a significant risk of unauthorized data exposure and manipulation. Organizations using this application should prioritize updates to mitigate potential cross-tenant data breaches.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
A Broken Object Level Authorization vulnerability exists in Grashjs Atlas CMMS prior to v1.6.0. An authenticated user from one tenant can read and modify another tenant's company record by changing only the numeric ID in the /company/{id} endpoint. The application does not enforce tenant-level ownership checks when accessing or updating company objects, allowing cross-tenant access and modification of company profile data.