The Augmentt web application contains an insecure direct object reference flaw that lets attackers bypass owner checks and retrieve or alter data belonging to other tenants. This can compromise both confidentiality and integrity of tenant data, with the weakness mapped to CWE‑639.

All deployed instances of the Augmentt web application are potentially vulnerable; no specific version information was supplied, so any deployment of the product may be impacted until a fix is applied.

Based on the description, it is inferred that the attack vector is via standard web requests that can guess or enumerate object identifiers. While EPSS data is not available and the vulnerability is not listed in CISA’s KEV catalog, the cross‑tenant elevation potential makes it a high‐risk flaw. The CVSS score of 6.5 indicates moderate severity. Once the web application is reachable from a network or the internet, exploitation could occur with minimal effort from an unauthenticated user.