grocy CVE-2026-50890

Exploitation requires HTTP access to the grocy web application and specifically the stock spendings report at /stockreports/spendings, with the injection delivered through the product-group parameter. The CVSS vector marks PR:N/UI:N (no privileges or user interaction), but as a practical limiting factor grocy is normally an authenticated application intended for private deployment, so reachability typically depends on the instance being network-accessible to the attacker and, likely, on a valid session or an auth-disabled configuration - authentication requirements are not definitively confirmed from the available data and should be verified against the endpoint. Exploitation is confined to grocy v4.6.0 as described.

The signals are mixed. CVSS 3.1 rates this 9.8 Critical with a fully remote, unauthenticated, low-complexity vector (AV:N/AC:L/PR:N/UI:N) and total confidentiality/integrity/availability impact, and SSVC concurs that exploitation is automatable with total technical impact - consistent with a straightforward SQLi. However, EPSS is only 0.15% (5th percentile), and SSVC exploitation status is merely 'poc' (not active), and the CVE is not in CISA KEV, which together suggest real-world exploitation is currently limited rather than widespread - plausibly a function of grocy's modest deployment footprint rather than difficulty. One caveat: the CVSS assigns PR:N, but grocy's spendings report is part of an authenticated application UI, so real-world exploitation may in practice require a valid session or a deployment with authentication disabled - verify against the actual endpoint's auth handling. Net: technically high-severity and easy to exploit if reachable, but the practical priority is moderated by low prevalence and no evidence of active exploitation.

An attacker who can reach the grocy web interface sends a GET request to /stockreports/spendings with a crafted product-group value containing SQL syntax (e.g., a UNION-based or boolean/time-based payload), causing the backend to return or leak database contents such as stored household and inventory data. Because publicly available exploit code exists in a gist and the vector is network-based with low complexity, the barrier to reproduction is low for anyone with access to the endpoint.