CyberRota Analysis
AI-GeneratedThe vulnerability allows authenticated users in one organization to access and manipulate data belonging to another organization due to improper verification of entity IDs in the Shelf platform prior to version 1.20.2. This cross-tenant IDOR could lead to unauthorized data exposure and manipulation, posing a significant risk to data integrity and confidentiality. Organizations using Shelf should prioritize upgrading to version 1.20.2 to mitigate this high-severity risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Shelf is a platform for tracking physical assets. Shelf is multi-tenant; data is isolated per organization (workspace). Prior to version 1.20.2, several endpoints accepted entity IDs from request input and `connect`-ed / read / updated them without verifying the IDs belonged to the caller's organization. An authenticated user in Org A who knew or obtained an ID belonging to Org B could act on Org B's data across organization boundaries (a cross-tenant IDOR). A loader-only restriction on personal-workspace bookings was also bypassable via a crafted POST. Version 1.20.2 patches the issue. No known workarounds are available.