CVE-2026-47697 in Shelf
Summary
by MITRE • 07/22/2026
Shelf is a platform for tracking physical assets. Shelf is multi-tenant; data is isolated per organization (workspace). Prior to version 1.20.2, several endpoints accepted entity IDs from request input and `connect`-ed / read / updated them without verifying the IDs belonged to the caller's organization. An authenticated user in Org A who knew or obtained an ID belonging to Org B could act on Org B's data across organization boundaries (a cross-tenant IDOR). A loader-only restriction on personal-workspace bookings was also bypassable via a crafted POST. Version 1.20.2 patches the issue. No known workarounds are available.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability represents a critical cross-tenant insecure direct object reference flaw in the Shelf platform that undermines the fundamental multi-tenancy security model. The issue stems from insufficient input validation and authorization checks across multiple endpoints that handle entity identifiers, allowing authenticated users to access and manipulate data belonging to other organizations within the same system. The vulnerability specifically affects versions prior to 1.20.2 where the platform failed to enforce proper tenant isolation mechanisms when processing request parameters containing entity IDs.
The technical implementation flaw manifests in how the system processes entity identifiers without performing mandatory tenant ownership verification. When users submit requests containing entity IDs through various endpoints, the platform connects to and operates on these entities without confirming whether the requesting user's organization has legitimate access rights to the specified data. This creates a direct pathway for privilege escalation where an authenticated user from organization A can exploit knowledge of valid entity IDs belonging to organization B to perform read, update, or delete operations across tenant boundaries. The vulnerability is particularly dangerous because it bypasses the expected security controls that should prevent cross-tenant data access.
The operational impact of this vulnerability extends beyond simple unauthorized data access, potentially enabling comprehensive data manipulation and exfiltration across organizational boundaries. An attacker could leverage this flaw to view sensitive information belonging to other organizations, modify booking records, delete critical assets, or even disrupt business operations within targeted tenant environments. The loader-only restriction bypass on personal-workspace bookings adds another dimension of risk, as it demonstrates the platform's inadequate authorization enforcement mechanisms that allow users with limited privileges to circumvent intended access controls through crafted requests.
This vulnerability aligns with common weakness enumeration CWE-639, which specifically addresses insecure direct object reference in multi-tenant systems. From an attack perspective, this flaw maps directly to techniques described in the attack pattern taxonomy under IDOR (Insecure Direct Object Reference) categories that exploit weak access control mechanisms. The security implications are particularly severe in SaaS environments where tenant isolation is paramount, as demonstrated by the fact that this vulnerability allows for cross-tenant data exposure without requiring additional privileges or complex exploitation techniques. Organizations relying on Shelf for asset tracking face significant risks including data breaches, regulatory compliance violations, and potential loss of customer trust when this vulnerability exists in their environment.
The recommended mitigation strategy involves immediate deployment of version 1.20.2 which implements proper tenant validation checks for all entity ID operations. System administrators should conduct thorough security assessments to ensure all endpoints properly validate that requested entity IDs belong to the authenticated user's organization and implement comprehensive logging of cross-tenant access attempts. Additionally, organizations should review their authorization policies and consider implementing additional monitoring controls to detect unauthorized attempts to access data across tenant boundaries, as this vulnerability represents a fundamental breakdown in the multi-tenancy security model that could potentially affect other similar platforms with comparable architectural flaws.