CVE-2026-44204
Shelf: SQL Injection via sortBy Parameter
CVSS Score
6.5
EPSS Score
0.0%
EPSS Percentile
0th
Shelf is a platform for tracking physical assets. From 1.12 to before 1.20.1, a SQL injection vulnerability in the sortBy query parameter on the /assets route allows any authenticated user (any role) to execute arbitrary SQL and read data from any table in the database, including data belonging to other organizations. This vulnerability is fixed in 1.20.1.
| CWE | CWE-20 CWE-89 |
| Vendor | shelf-nu |
| Product | shelf.nu |
| Published | May 12, 2026 |
Stay Ahead of the Next One
Get instant alerts for shelf-nu shelf.nu
Be the first to know when new medium vulnerabilities affecting shelf-nu shelf.nu are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
Affected Versions
Shelf-nu / shelf.nu
>= 1.12, < 1.20.1