EUVD-2026-69390
GHSA-6cjx-9x4p-x26w
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Network-accessible REST API with trivial sequential ID enumeration (AC:L), exploitable by any authenticated tenant user (PR:L); C:H and I:H reflect cross-tenant read and write capability; no availability impact.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
7DescriptionCVE.org
A Broken Object Level Authorization vulnerability exists in Grashjs Atlas CMMS prior to v1.6.0. An authenticated user from one tenant can read and modify another tenant's company record by changing only the numeric ID in the /company/{id} endpoint. The application does not enforce tenant-level ownership checks when accessing or updating company objects, allowing cross-tenant access and modification of company profile data.
AnalysisAI
Cross-tenant data exposure and modification in Grashjs Atlas CMMS prior to v1.6.0 allows any authenticated user to read and overwrite another tenant's company profile by substituting a numeric ID in the /company/{id} REST endpoint. The application's CompanyController and CompanySettingsController accepted arbitrary object IDs without verifying that the resolved object belonged to the requesting user's own tenant, enabling full cross-tenant confidentiality breach (C:H) and unauthorized data modification (I:H). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must hold a valid authenticated account on the target Grashjs Atlas CMMS instance (PR:L); unauthenticated exploitation is not possible. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.1 score (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) accurately reflects the real-world risk profile: trivial exploitation by any valid user account, no special tooling or elevated privileges required, and direct read/write access to other tenants' organizational records. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Grashjs Atlas CMMS to v1.6.0 or later, which incorporates the tenant ownership check introduced in commit 283bbc985cda497d6b592faae45ae1dbc8d53966. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify your current Atlas CMMS version and which business units have system access; assess the sensitivity of data stored in company profiles (financial information, contact details, operational settings). …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-284 – Improper Access Control
View allShare
External POC / Exploit Code
Leaving vuln.today