CVE-2026-47697

Shelf is a platform for tracking physical assets. Shelf is multi-tenant; data is isolated per organization (workspace). Prior to version 1.20.2, several endpoints accepted entity IDs from request input and `connect`-ed / read / updated them without verifying the IDs belonged to the caller's organization. An authenticated user in Org A who knew or obtained an ID belonging to Org B could act on Org B's data across organization boundaries (a cross-tenant IDOR). A loader-only restriction on personal-workspace bookings was also bypassable via a crafted POST. Version 1.20.2 patches the issue. No known workarounds are available.

CVSS v3 7.1 HIGH

7.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 4.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/Shelf-nu/shelf.nu/security/advisories/GHSA-r46p-gfrp-xxgq

Configurations

No configuration.

History

24 Oct 2026, 19:10

Type	Values Removed	Values Added
Summary		(es) Shelf es una plataforma para el seguimiento de activos físicos. Shelf es multi-inquilino; los datos están aislados por organización (espacio de trabajo). Antes de la versión 1.20.2, varios puntos finales aceptaban ID de entidad de la entrada de la solicitud y los ’conectaban’ / leían / actualizaban sin verificar que los ID pertenecieran a la organización del llamador. Un usuario autenticado en la Org A que conocía u obtenía un ID perteneciente a la Org B podía actuar sobre los datos de la Org B a través de los límites de la organización (un IDOR entre inquilinos). Una restricción de solo cargador en las reservas de espacios de trabajo personales también era eludible mediante un POST manipulado. La versión 1.20.2 corrige el problema. No se conocen soluciones alternativas disponibles.

Information

Published : 2026-07-21 21:16

Updated : 2026-10-24 19:10

NVD link : CVE-2026-47697

Mitre link : CVE-2026-47697

CVE.ORG link : CVE-2026-47697

JSON object : View

Products Affected

No product.

CWE

CWE-863

Incorrect Authorization

{"id": "CVE-2026-47697", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-47697", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-22T15:38:12.717785Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 4.2, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "Shelf-nu", "product": "shelf.nu", "versions": [{"status": "affected", "version": "< 1.20.2"}]}]}], "published": "2026-07-21T21:16:51.340", "references": [{"url": "https://github.com/Shelf-nu/shelf.nu/security/advisories/GHSA-r46p-gfrp-xxgq", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "Shelf is a platform for tracking physical assets. Shelf is multi-tenant; data is isolated per organization (workspace). Prior to version 1.20.2, several endpoints accepted entity IDs from request input and `connect`-ed / read / updated them without verifying the IDs belonged to the caller's organization. An authenticated user in Org A who knew or obtained an ID belonging to Org B could act on Org B's data across organization boundaries (a cross-tenant IDOR). A loader-only restriction on personal-workspace bookings was also bypassable via a crafted POST. Version 1.20.2 patches the issue. No known workarounds are available."}, {"lang": "es", "value": "Shelf es una plataforma para el seguimiento de activos f\u00edsicos. Shelf es multi-inquilino; los datos est\u00e1n aislados por organizaci\u00f3n (espacio de trabajo). Antes de la versi\u00f3n 1.20.2, varios puntos finales aceptaban ID de entidad de la entrada de la solicitud y los \u2019conectaban\u2019 / le\u00edan / actualizaban sin verificar que los ID pertenecieran a la organizaci\u00f3n del llamador. Un usuario autenticado en la Org A que conoc\u00eda u obten\u00eda un ID perteneciente a la Org B pod\u00eda actuar sobre los datos de la Org B a trav\u00e9s de los l\u00edmites de la organizaci\u00f3n (un IDOR entre inquilinos). Una restricci\u00f3n de solo cargador en las reservas de espacios de trabajo personales tambi\u00e9n era eludible mediante un POST manipulado. La versi\u00f3n 1.20.2 corrige el problema. No se conocen soluciones alternativas disponibles."}], "lastModified": "2026-10-24T19:10:00.127", "sourceIdentifier": "security-advisories@github.com"}