CVE-2026-47697

{
  "id": "CVE-2026-47697",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-21T21:16:51.340",
  "lastModified": "2026-10-24T19:10:00.127",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Shelf is a platform for tracking physical assets. Shelf is multi-tenant; data is isolated per organization (workspace). Prior to version 1.20.2, several endpoints accepted entity IDs from request input and `connect`-ed / read / updated them without verifying the IDs belonged to the caller's organization. An authenticated user in Org A who knew or obtained an ID belonging to Org B could act on Org B's data across organization boundaries (a cross-tenant IDOR). A loader-only restriction on personal-workspace bookings was also bypassable via a crafted POST. Version 1.20.2 patches the issue. No known workarounds are available."
    },
    {
      "lang": "es",
      "value": "Shelf es una plataforma para el seguimiento de activos físicos. Shelf es multi-inquilino; los datos están aislados por organización (espacio de trabajo). Antes de la versión 1.20.2, varios puntos finales aceptaban ID de entidad de la entrada de la solicitud y los ’conectaban’ / leían / actualizaban sin verificar que los ID pertenecieran a la organización del llamador. Un usuario autenticado en la Org A que conocía u obtenía un ID perteneciente a la Org B podía actuar sobre los datos de la Org B a través de los límites de la organización (un IDOR entre inquilinos). Una restricción de solo cargador en las reservas de espacios de trabajo personales también era eludible mediante un POST manipulado. La versión 1.20.2 corrige el problema. No se conocen soluciones alternativas disponibles."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Shelf-nu",
          "product": "shelf.nu",
          "versions": [
            {
              "version": "< 1.20.2",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
          "baseScore": 7.1,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 4.2
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-22T15:38:12.717785Z",
          "id": "CVE-2026-47697",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-863"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/Shelf-nu/shelf.nu/security/advisories/GHSA-r46p-gfrp-xxgq",
      "source": "[email protected]"
    }
  ]
}