Night Shift
Monthly
A crafted license plate value submitted through the bulk license plate search feature of Flock's Night Shift hosted service can be used to inject SQL, allowing an authenticated user of one customer organization to read license plate recognition records and other data belonging to other customer tenants; data modification was not possible. Exploitation requires a valid tenant account on the hosted platform (PR:L per the assessed vector), so this is not an unauthenticated attack. Flock discovered the flaw through internal security review, remediated it server-side on 2026-08-12, and states no customer action is required; no public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis, and because the fix was applied to the hosted platform the issue is no longer exploitable. The vendor-assigned CVSS 4.0 score is 7.1, while the independent assessment rates it CVSS 3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, reflecting high confidentiality impact confined to cross-tenant read access.
A crafted license plate value submitted through the bulk license plate search feature of Flock's Night Shift hosted service can be used to inject SQL, allowing an authenticated user of one customer organization to read license plate recognition records and other data belonging to other customer tenants; data modification was not possible. Exploitation requires a valid tenant account on the hosted platform (PR:L per the assessed vector), so this is not an unauthenticated attack. Flock discovered the flaw through internal security review, remediated it server-side on 2026-08-12, and states no customer action is required; no public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis, and because the fix was applied to the hosted platform the issue is no longer exploitable. The vendor-assigned CVSS 4.0 score is 7.1, while the independent assessment rates it CVSS 3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, reflecting high confidentiality impact confined to cross-tenant read access.