CVEvulnerability

CVE-2026-44204

6.5 MEDIUM Published 2026-05-12 Modified 2026-06-17 Official page ↗
Status
Deferred
Published
2026-05-12
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-20, CWE-89

Description

Shelf is a platform for tracking physical assets. From 1.12 to before 1.20.1, a SQL injection vulnerability in the sortBy query parameter on the /assets route allows any authenticated user (any role) to execute arbitrary SQL and read data from any table in the database, including data belonging to other organizations. This vulnerability is fixed in 1.20.1.

Related

Weakness · CWE (2)

  • CWE-20 Improper Input Validation weakness
  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness

References