CVE-2026-51956

A Broken Object Level Authorization vulnerability exists in Grashjs Atlas CMMS prior to v1.6.0. An authenticated user from one tenant can read and modify another tenant's company record by changing only the numeric ID in the /company/id endpoint. The application does not enforce tenant-level...

CVE-2026-51956

A Broken Object Level Authorization vulnerability exists in Grashjs Atlas CMMS prior to v1.6.0. An authenticated user from one tenant can read and modify another tenant's company record by changing only the numeric ID in the /company/id endpoint. The application does not enforce tenant-level...

PT-2026-84360

Name of the Vulnerable Software and Affected Versions Grashjs Atlas CMMS versions prior to 1.6.0 Description A Broken Object Level Authorization issue allows an authenticated user from one tenant to read and modify the company record of another tenant. This occurs because the application fails to...

CVE-2026-51956

A Broken Object Level Authorization vulnerability exists in Grashjs Atlas CMMS prior to v1.6.0. An authenticated user from one tenant can read and modify another tenant's company record by changing only the numeric ID in the /company/id endpoint. The application does not enforce tenant-level...

EUVD-2026-69390

A Broken Object Level Authorization vulnerability exists in Grashjs Atlas CMMS prior to v1.6.0. An authenticated user from one tenant can read and modify another tenant's company record by changing only the numeric ID in the /company/id endpoint. The application does not enforce tenant-level...

CVE-2026-51956: Improper Access Control

A Broken Object Level Authorization vulnerability exists in Grashjs Atlas CMMS prior to v1.6.0. An authenticated user from one tenant can read and modify another tenant's company record by changing only the numeric ID in the /company/id endpoint. The application does not enforce tenant-level...

CVE-2026-51956

A Broken Object Level Authorization vulnerability exists in Grashjs Atlas CMMS prior to v1.6.0. An authenticated user from one tenant can read and modify another tenant's company record by changing only the numeric ID in the /company/id endpoint. The application does not enforce tenant-level...

CVE-2026-51956

A Broken Object Level Authorization vulnerability exists in Grashjs Atlas CMMS prior to v1.6.0 . The root cause is a failure to enforce tenant-level ownership checks when accessing or updating company objects via the /company/{id} endpoint. An authenticated user from one tenant can read and modif...

GHSA-575R-357H-FHCH Snipe-IT vulnerable to cross-company asset maintenance re-parenting via API update

Impact The API endpoint for updating asset maintenance records allows an authorized user to change the assetid of an existing maintenance record to an asset outside their company scope. In a Full Multiple Company Support / multi-company deployment, this allows a user from Company A to attach or...

Snipe-IT vulnerable to cross-company asset maintenance re-parenting via API update

Impact The API endpoint for updating asset maintenance records allows an authorized user to change the assetid of an existing maintenance record to an asset outside their company scope. In a Full Multiple Company Support / multi-company deployment, this allows a user from Company A to attach or...

EUVD-2026-42995

Snipe-IT: Cross-company deletion of pending checkout acceptances via unscoped report endpoint...

GHSA-35CR-9HQQ-P2MG Snipe-IT: Cross-company deletion of pending checkout acceptances via unscoped report endpoint

Impact A user with the reports.view permission can delete pending checkout acceptance records by global ID, even when the acceptance belongs to an asset in another company. The report listing page appears to scope visible unaccepted assets, but the delete endpoint directly looks up...

Snipe-IT: Cross-company deletion of pending checkout acceptances via unscoped report endpoint

Impact A user with the reports.view permission can delete pending checkout acceptance records by global ID, even when the acceptance belongs to an asset in another company. The report listing page appears to scope visible unaccepted assets, but the delete endpoint directly looks up...

Snipe-IT's API Location Creation Bypasses FMCS Parent-Child Company Boundary Validation

Impact When Full Multiple Companies Support and scopelocationsfmcs are both enabled, the API endpoint for creating locations can still create a child location under a parent location from a different company. The code detects the invalid parent/child company mismatch, but it appears not to return...

GHSA-8W8C-8MX9-52CW Snipe-IT's API Location Creation Bypasses FMCS Parent-Child Company Boundary Validation

Impact When Full Multiple Companies Support and scopelocationsfmcs are both enabled, the API endpoint for creating locations can still create a child location under a parent location from a different company. The code detects the invalid parent/child company mismatch, but it appears not to return...

EUVD-2026-42990

Snipe-IT's API Location Creation Bypasses FMCS Parent-Child Company Boundary Validation...

EUVD-2026-67144

FrontAccounting through 2.4.20 generates a CSRF token in endform in includes/ui/uicontrols.inc and embeds it as the token hidden field in every form it renders, but only admin/users.php and admin/changecurrentuserpassword.php call checkcsrftoken to validate it. No financial transaction handler...

CVE-2026-81102: Origin Validation Error

The Dash MCP server bound its listener to the loopback address but never checked the host a request named. src/mcpserverdash.py constructed the server for its network mode with the interface restricted to loopback and no transport-security settings, so a name that had been pointed at the loopback...

CVE-2026-77142

The frontend company self-service editing feature relies on a template-level visibility flag to hide the edit form for company records a visitor does not own, but the corresponding write operation does not repeat this ownership check on the server side. As a result, a visitor who knows the...

CVE-2026-77142 Broken Access Control in extension "Industry Directory" (yellowpages2)

The frontend company self-service editing feature relies on a template-level visibility flag to hide the edit form for company records a visitor does not own, but the corresponding write operation does not repeat this ownership check on the server side. As a result, a visitor who knows the...