Read the docs
TI-2026-35201 Aliases CVE-2026-47697

Incorrect authorization in Shelf-nu shelf.nu

Priority LOW 31CWE-863Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-863.

Summary

Shelf is a platform for tracking physical assets. Shelf is multi-tenant; data is isolated per organization (workspace). Prior to version 1.20.2, several endpoints accepted entity IDs from request input and `connect`-ed / read / updated them without verifying the IDs belonged to the caller's organization. An authenticated user in Org A who knew or obtained an ID belonging to Org B could act on Org B's data across organization boundaries (a cross-tenant IDOR). A loader-only restriction on personal-workspace bookings was also bypassable via a crafted POST. Version 1.20.2 patches the issue. No known workarounds are available.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00308 23rd percentileScored 2026-11-07
Fix Fixed shelf.nu (Shelf-nu): 1.20.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Shelf-nushelf.nubefore 1.20.21.20.2Patch availableCNA
  • shelf.nu VendorShelf-nu Affected before 1.20.2 Fixed in 1.20.2 Patch available CNA

Remediation

  • Fix · CNA shelf.nu (Shelf-nu) Fixed in 1.20.2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-47697

References

Other 1

  • TI-2026-32183 Shelf: SQL Injection via sortBy Parameter CVSS 3.1MEDIUM 6.5
  • TI-2026-39074 Shelf Vulnerable to Server-Side Request Forgery (SSRF) via Asset CSV Import imageUrl Validation Bypass CVSS 3.1HIGH 7.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences