A broken object‑level authorization flaw allows an authenticated user from one tenant to read and modify another tenant’s company record by simply changing the numeric ID in the /company/{id} endpoint. This flaw exists because the application does not perform tenant‑level ownership checks when accessing or updating company objects, permitting cross‑tenant access and alteration of sensitive company profile data. It is inferred that cross‑tenant data modification could compromise confidentiality, integrity, and availability of company information across tenants, potentially disrupting tenant operations. Based on the description, it is inferred that the attacker can gain unauthorized access and modify data without further privileges beyond authentication.

Grashjs Atlas CMMS deployments that are running any pre‑1.6.0 version are affected. The vulnerability is present in all releases prior to v1.6.0, and the fix was introduced in the commit referenced in the advisory. The affected version details are in the CNA’s affected-version data, but limited here to the pre‑1.6.0 range.

CVSS score of 8.1 reflects a high severity due to the ease of exploitation and potential impact. EPSS score of <1% indicates a low overall likelihood of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. The attacker only needs valid credentials for one tenant and a target company ID; this requirement is inferred from the fact that the flaw is only triggered by changing the numeric ID. The likely attack vector is an authenticated request to the /company/{id} endpoint with a manipulated company ID belonging to another tenant.