CVE-2026-47697

HighCVSS 7.1

Published: 21/07/2026(UTC)Updated: 24/10/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.31%

23th percentile - higher than 23% of all known CVEs

Summary

Shelf prior to version 1.20.2 has an IDOR vulnerability that allows an authenticated user from organization A to access data of organization B by manipulating entity IDs. Additionally, booking restrictions can be bypassed via a crafted POST request.

Risk Assessment

An attacker can gain unauthorized access to data of other organizations, leading to breach of tenant data isolation.

Recommendation

Update Shelf to version 1.20.2 or later.

Other vulnerabilities in Shelf

CVE-2026-54166High
In Shelf, authenticated users with the asset:import permission can trigger server-side HTTP requests to attacker-controlled URLs through the Asset CSV Content Import feature. The imageUrl validation can be bypassed via image-extension suffixes, image-related path keywords, domain substring matching, and redirect chains, resulting in a Server-Side Request Forgery (SSRF) vulnerability. Additionally, response bodies are fully buffered before size validation, creating a memory exhaustion vector.

Original NVD description (English source)

Shelf is a platform for tracking physical assets. Shelf is multi-tenant; data is isolated per organization (workspace). Prior to version 1.20.2, several endpoints accepted entity IDs from request input and `connect`-ed / read / updated them without verifying the IDs belonged to the caller's organization. An authenticated user in Org A who knew or obtained an ID belonging to Org B could act on Org B's data across organization boundaries (a cross-tenant IDOR). A loader-only restriction on personal-workspace bookings was also bypassable via a crafted POST. Version 1.20.2 patches the issue. No known workarounds are available.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS