A high-severity authorization flaw in Grashjs Atlas CMMS permits cross-tenant data modification, posing a significant risk to data integrity and confidentiality.

The application suffers from a Broken Object Level Authorization (BOLA) vulnerability within the /company/{id} endpoint. An authenticated user can bypass tenant-level security boundaries to read or alter company profiles belonging to other organizations simply by iterating the numeric ID parameter.

The ability for a standard authenticated user to perform unauthorized read and write operations on cross-tenant data creates a severe risk of sensitive information disclosure and unauthorized data manipulation. With a CVSS score of 8.1, this vulnerability is classified as high severity, as it directly violates the multi-tenant isolation model essential for SaaS and shared-infrastructure deployments.

Immediate Action: Update Grashjs Atlas CMMS to version 1.6.0 or later, which incorporates the necessary tenant-level ownership checks.

Proactive Monitoring: Review application logs for anomalous patterns of sequential ID access or unexpected modifications originating from standard user accounts.

Compensating Controls: Implement strict object-level access control middleware that validates the relationship between the authenticated user's tenant ID and the requested resource ID before processing the request.

Public Exploit Available: No (exploit_available: false)

Given the high impact on data confidentiality and integrity, administrators must prioritize upgrading to version 1.6.0 immediately. Organizations unable to patch should implement strict server-side validation to ensure that any request to the /company/ endpoint strictly enforces ownership verification based on the active session's tenant context.