Broken Object Level Authorization in Grashjs Atlas CMMS

Executive Summary

CVE-2026-51956 is a Broken Object Level Authorization (BOLA) vulnerability in Grashjs Atlas CMMS versions prior to 1.6.0. It allows authenticated users from one tenant to read or modify another tenant's company data by changing the numeric ID in the /company/{id} API endpoint. The application fails to enforce tenant-level ownership checks, enabling cross-tenant access.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor API requests to /company/{id} endpoints for unauthorized access attempts. Check for repeated requests with varying numeric IDs from the same authenticated user. Look for error responses like 403 Forbidden or 'Access denied' messages in logs. Use tools like Burp Suite or OWASP ZAP to intercept and analyze API traffic for improper authorization checks.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could allow unauthorized users to access or alter sensitive company data belonging to other tenants. Attackers could read confidential company profiles or modify critical business information, leading to data breaches, financial loss, or operational disruptions. The impact depends on the data exposed and the actions taken by the attacker.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to non-compliance with GDPR, HIPAA, and other data protection regulations. Unauthorized access to personal or sensitive data may violate privacy requirements, result in legal penalties, and damage trust. Organizations using affected versions must address this to maintain regulatory compliance.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade Atlas CMMS to version 1.6.0 or later. If upgrading is not possible, implement server-side validation to ensure users can only access or modify data belonging to their own company by comparing the company ID with the user's associated company ID. Add role-based permission checks for update operations and improve error handling to provide clear feedback for unauthorized access attempts.

Useful 0 Not Useful 0