Executive brief
Grashjs Atlas is a self-hosted maintenance management system (CMMS) used by enterprises to track and manage equipment maintenance. A flaw in the application allows any authenticated user to access and modify company records belonging to other tenants by simply changing the numeric ID in API requests, bypassing tenant isolation controls and potentially exposing or corrupting sensitive company profile data across the system.
Technical details
A broken object level authorization (BOLA) vulnerability exists in the /company/{id} endpoint of Grashjs Atlas CMMS prior to v1.6.0. The application fails to enforce tenant-level ownership checks when retrieving or updating company objects, allowing authenticated users to access data outside their own tenant context. An attacker with valid credentials can enumerate and modify company records by incrementing the numeric ID parameter, achieving cross-tenant read and write access to company profile data. The vulnerability requires authentication but no additional user interaction. A fix was published in commit 283bbc9 adding access control validation to ensure users can only access data within their own company.
Affected products
- Grashjs Atlas CMMS prior to v1.6.0
Timeline
- 2026-09-01: disclosed
- 2026-09-01: patched: Fix available in v1.6.0 via commit 283bbc9