EUVD-2026-97239
GHSA-q44v-8ffc-wmr7
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as Night Shift customer user
-
ExploitSubmit crafted plate in bulk search
-
ExecutionTrigger SQL injection in backend query
-
ImpactRead other organizations' ALPR records
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a valid authenticated account on the Flock Night Shift hosted service (PR:L) and use of the bulk license plate search feature, into which the attacker submits a crafted license plate value to inject SQL. Limiting factors: a legitimate tenant login is mandatory (no unauthenticated access), impact is confined to reading data (no modification possible), and because the fix was deployed server-side on 2026-08-12 to the hosted platform, the vulnerability is no longer exploitable and no customer-side configuration or action is involved. |
| Impact | The signals are moderate and internally consistent. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N) describes a network-reachable, low-complexity flaw requiring a valid authenticated account (PR:L) with high confidentiality impact but no integrity or availability impact - matching the description's statement that data could be read but not modified. There is no EPSS score, no CISA KEV listing, and no public exploit identified at time of analysis, so there is no evidence of active or opportunistic exploitation. Critically, this is a hosted (SaaS) service and Flock states it identified the issue through internal security review and remediated it server-side on 2026-08-12 with no customer action required, meaning the live exposure window is effectively closed for all tenants simultaneously. This is therefore a genuine confidentiality issue (cross-tenant data leakage of license-plate recognition records, which are privacy-sensitive) rather than an inflated high-CVSS-but-low-impact finding, but its forward-looking operational risk is low because it is already patched at the source and requires authenticated access. Note one point to verify with the vendor: the cross-organization data access implies a tenant-isolation (scope) boundary crossing, yet the vendor's 4.0 vector sets all subsequent-system metrics to N - defensible if the data is modeled within one logical application, but worth confirming. |
| Exploit ScenarioDerived | An authenticated Flock Night Shift customer user enters a specially crafted value into the bulk license plate search feature; the malformed input is concatenated into a backend SQL query (CWE-89), causing the service to return license plate recognition records belonging to other customer organizations. The attack is network-based and low-complexity but requires a valid tenant account, and it only permits reading data, not modification. No public exploit code is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 12, 2026
A crafted license plate value submitted through the bulk license plate search feature of Flock's Night Shift hosted service can be used to inject SQL, allowing an authenticated user of one customer organization to read license plate recognition records and other data belonging to other customer tenants; data modification was not possible. Exploitation requires a valid tenant account on the hosted platform (PR:L per the assessed vector), so this is not an unauthenticated attack. Flock discovered the flaw through internal security review, remediated it server-side on 2026-08-12, and states no customer action is required; no public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis, and because the fix was applied to the hosted platform the issue is no longer exploitable. The vendor-assigned CVSS 4.0 score is 7.1, while the independent assessment rates it CVSS 3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, reflecting high confidentiality impact confined to cross-tenant read access.
RemediationAI
Primary remediation is already complete on the vendor side: Flock remediated the SQL injection server-side on 2026-08-12 as part of its hosted Night Shift platform, and the vendor explicitly states that no customer action is required. Because the flaw was in hosted service code, there is no customer-deployed patch, version upgrade, or configuration change to apply; the only externally available guidance is Flock's security advisory at https://www.flocksafety.com/legal/security-advisories. Operators of Night Shift should verify with Flock that their tenant is on the remediated service and, as a precaution, review license plate recognition query and access logs for the pre-2026-08-12 period for anomalous bulk search activity originating from accounts that would not normally use that feature. Relevant compensating controls, which are defensive rather than fixes, include restricting which roles in the tenant can access bulk license plate search (trade-off: reduces investigative throughput for legitimate users) and alerting on unusually large or high-frequency bulk search result sets (trade-off: potential false positives from routine patrol or audit workflows). Since the independent assessment confirms the vulnerability is no longer exploitable after the server-side fix and no public exploit code has been identified, no network-level blocking or feature disablement is warranted, and none of these controls should be treated as a substitute for confirming remediation status with the vendor.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-89, improper neutralization of special elements used in an SQL command, in the bulk license plate search function of the Night Shift hosted service. A user-supplied license plate string was incorporated into a backend SQL query without adequate parameterization or escaping, so a crafted value could alter the query's logic; combined with the multi-tenant nature of the hosted service, the resulting query was not sufficiently constrained to the caller's own organization, which is what enabled cross-customer reads of license plate recognition records. The CPE string cpe:2.3:a:flock:night_shift:*:*:*:*:*:*:*:* uses a wildcard version because Night Shift is delivered exclusively as a hosted service with no customer-installed code, so there are no versioned binaries to track. The assessed vector AV:N/AC:L/PR:L/UI:N with VC:H but VI:N and VA:N maps precisely to the reported behavior: network-reachable, low-complexity, authenticated, no user interaction, and read-only impact with no integrity or availability loss, and scope remains unchanged (S:U) because the exposure is confined to data belonging to tenants of the same platform rather than extending the attacker's privileges over other components.
Know when Flock gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Network-reachable (AV:N), straightforward crafted input (AC:L), requires an authenticated tenant account (PR:L), no user interaction; high confidentiality from cross-tenant reads, no integrity or availability impact.
Primary rating from Vendor (flock).
CVSS VectorVendor: flock
DescriptionCVE.org
SQL injection in the bulk license plate search of the Flock Night Shift hosted service allowed an authenticated user to read other customer organizations' data, including license plate recognition records, via a crafted license plate value. Data could not be modified. Flock identified the issue through internal security review and remediated it on 2026-08-12; no customer action is required.
Executive ViewAI
A SQL injection flaw in the bulk license plate search feature of Flock's Night Shift hosted license-plate-recognition service allowed an authenticated user belonging to one customer tenant to read license plate recognition records and other data belonging to other customer organizations, though no data modification was possible. The impact falls squarely on law-enforcement and municipal customers whose ALPR data can reveal vehicle locations and movement patterns across jurisdictions, making any cross-tenant exposure a privacy, civil-liberties, and contractual trust issue rather than a routine IT defect. Flock reports it remediated the flaw server-side on 2026-08-12 and states no customer action is required, so leadership should treat this as a vendor-assurance and third-party-risk matter rather than an open technical exposure.
No customer-side patch exists because the flaw was in a hosted service and was remediated server-side by the vendor on 2026-08-12; per the vendor, no customer action is required. Interim mitigations available to customer organizations are administrative rather than technical: restrict bulk license plate search to the minimum set of authenticated tenant users, review and recertify tenant account entitlements, monitor and audit query activity and data volumes for anomalous cross-tenant access, and obtain written vendor confirmation and any applicable incident reporting.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Exploit-DB