CVE-2026-51956

HighCVSS 8.1/10Last modified Sep 2, 2026

Description

A Broken Object Level Authorization vulnerability exists in Grashjs Atlas CMMS prior to v1.6.0. An authenticated user from one tenant can read and modify another tenant's company record by changing only the numeric ID in the /company/{id} endpoint. The application does not enforce tenant-level ownership checks when accessing or updating company objects, allowing cross-tenant access and modification of company profile data.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-284

Affected software

No affected versions have been published.

Timeline

Published
Sep 1, 2026
Last modified
Sep 2, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-51966.3A vulnerability has been found in code-projects Student Membership System 1.0. Impacted is an unknown function of the file /delete_member.phCVE-2026-51976.3A vulnerability was found in code-projects Student Membership System 1.0. The affected element is an unknown function of the file /delete_usCVE-2026-519748.8An eval() injection vulnerability in the get_list function in modules/meta_parser.py in lllyasviel Fooocus 2.1.854 through 2.5.5 allows remoCVE-2026-519779.1An issue in Trueview T18061 WiFi 3MP Robot Pan-Tilt Security Camera Version 1.0 allows a physically proximate attacker to escalate privilegeCVE-2026-51987.3A vulnerability was determined in code-projects Student Membership System 1.0. The impacted element is an unknown function of the file /admiCVE-2026-51992.3A writer role user in an attacker-controlled namespace could signal, delete, and reset workflows or activities in a victim namespace on the CVE-2026-519909.8An issue in Sogou Sogou Input Method < 16.3.0.3498 (fixed in 16.3.0.3498) allows a remote attacker to execute arbitrary code via the biz_helCVE-2026-519949.1mcp-remote versions 0.1.32 through 0.1.38 are vulnerable to Server-Side Request Forgery (SSRF) via the resource_metadata URL extracted from CVE-2026-519957.5An issue in geelen mcp-remote 0.1.32 through 0.1.38 allows a remote attacker to obtain sensitive information via the src/lib/authorization-sCVE-2026-519969.8An issue in geelen mcp-remote 0.1.16 through 0.1.38 allows a remote attacker to execute arbitrary code via the src/lib/utils.ts and the getSCVE-2026-519978.8An issue in geelen mcp-remote 0.1.16 through 0.1.38 allows a remote attacker to execute arbitrary code via the open() functionsCVE-2026-52008.8The AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress plugin for WordPress is vulnerable to Missing