Cross-tenant IDOR in Shelf asset tracking platform (CVE-2026-47697)

Shelf, a multi-tenant physical asset tracking platform, failed to verify that entity IDs supplied in requests belonged to the caller's organization. An authenticated user in one organization could read or modify another organization's assets, tags, custodians, bookings, QR codes, and audit data by supplying a known foreign entity ID. A separate bypass allowed creation of bookings in personal workspaces despite a loader-level restriction. Affected versions: - < 1.20.2 We recommend updating to: 1.20.2. CVSS 7.1 · our assessment: this_week Reference: https://github.com/Shelf-nu/shelf.nu/security/advisories/GHSA-r46p-gfrp-xxgq Details: https://vuln.today/cve/CVE-2026-47697