Description

A Broken Object Level Authorization vulnerability exists in Grashjs Atlas CMMS prior to v1.6.0. An authenticated user from one tenant can read and modify another tenant's company record by changing only the numeric ID in the /company/{id} endpoint. The application does not enforce tenant-level ownership checks when accessing or updating company objects, allowing cross-tenant access and modification of company profile data.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-09-01T17:17:31.390Z",
  "pubdate": "2026-09-01T17:17:31.390Z",
  "executiveSummary": "A Broken Object Level Authorization (BOLA) vulnerability has been identified in Grashjs Atlas CMMS prior to version 1.6.0. This security flaw originates from the application's failure to perform adequate authorization checks to verify user ownership of specific resources within a multi-tenant architecture.\nThe vulnerability permits an authenticated user belonging to one tenant to gain unauthorized access to, and perform unauthorized modifications on, the company records of another tenant. By manipulating the numeric identifier within the /company/{id} endpoint, an attacker can bypass intended logical boundaries, leading to unauthorized data exposure and potential corruption of sensitive corporate profile information.\nThis issue poses a significant risk to data confidentiality and integrity within the multi-tenant environment. An attacker with standard user-level authentication is capable of traversing the application's data store across organizational silos. Since the application fails to validate the association between the authenticated session's tenant ID and the requested object ID, the system is susceptible to horizontal privilege escalation, compromising the isolation guarantees essential for SaaS-based CMMS platforms.",
  "technicalDetails": "The root cause of this vulnerability is the improper implementation of authorization logic at the object level within the Grashjs Atlas CMMS backend API. Specifically, the /company/{id} endpoint fails to enforce mandatory server-side checks to verify if the requesting user's tenant context matches the tenant ID associated with the requested company object. In a properly secured multi-tenant application, every resource request must be scoped to the authenticated user's authorization claims.\nThe exploitation of this vulnerability is straightforward and does not require elevated privileges beyond standard authenticated user access. An attacker logs into their own legitimate tenant account and identifies the structure of the API request used to fetch company profile data. By observing the traffic, the attacker identifies that the /company/{id} endpoint relies solely on a predictable numeric identifier to retrieve object data.\nThe attack flow proceeds as follows: First, the attacker authenticates with the application to obtain a valid session token. Second, the attacker interacts with the /company/{id} endpoint. Third, the attacker systematically iterates through integer values in the {id} parameter. Because the application processes these requests without verifying the resource's ownership, the backend controller performs a database lookup based solely on the provided ID. If the ID exists in the database, the server returns the full company profile associated with that ID, regardless of the attacker's actual tenant assignment.\nFurthermore, the vulnerability extends to HTTP PUT/POST methods targeting the same endpoint. An attacker can craft malicious requests to modify the company records of other tenants, allowing them to overwrite sensitive contact information, configuration settings, or operational data. This effectively allows for cross-tenant data manipulation.\nThe vulnerable component resides in the API middleware or controller responsible for handling company record retrieval and updates. Affected versions include all instances of Grashjs Atlas CMMS prior to v1.6.0. The vulnerability is exploitable over any network path that allows HTTP access to the application API, provided the attacker has an active session. Post-exploitation impact includes the full leakage of sensitive tenant metadata, potential disruption of business services, and the subversion of data isolation controls critical to the platform's multi-tenant integrity."
}