CVE-2026-51956: n/a

This vulnerability in Grashjs Atlas CMMS prior to version 1.6.0 arises from improper authorization checks at the object level. Specifically, authenticated users can manipulate the numeric ID parameter in the /company/{id} API endpoint to access and modify company records belonging to other tenants. The lack of tenant ownership enforcement leads to unauthorized disclosure and modification of sensitive company profile information across tenants.

An attacker with valid authentication credentials in one tenant can access and alter company data of other tenants, leading to high confidentiality and integrity impact. This cross-tenant access can result in unauthorized data exposure and unauthorized changes to company profiles. Availability is not impacted. The CVSS score is 8.1 (high severity) reflecting network attack vector, low attack complexity, and high confidentiality and integrity impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the /company/{id} endpoint to trusted users and monitor for suspicious cross-tenant access patterns. Implement additional tenant-level authorization checks in custom access controls if possible.