Shelf Nu
Monthly
Cross-tenant IDOR (broken authorization) in Shelf (shelf.nu) asset-tracking platform before version 1.20.2 allows an authenticated user in one organization to read, update, or connect records belonging to a different organization by supplying entity IDs that are never validated against the caller's workspace. Because Shelf is multi-tenant with per-organization data isolation, this breaks the core tenant boundary; a low-privilege user in Org A who learns or guesses an ID from Org B can act on Org B's data, and a loader-only restriction on personal-workspace bookings is bypassable via a crafted POST. No public exploit identified at time of analysis and the issue is not on CISA KEV, but the flaw is straightforward to abuse once a foreign ID is known.
Cross-tenant IDOR (broken authorization) in Shelf (shelf.nu) asset-tracking platform before version 1.20.2 allows an authenticated user in one organization to read, update, or connect records belonging to a different organization by supplying entity IDs that are never validated against the caller's workspace. Because Shelf is multi-tenant with per-organization data isolation, this breaks the core tenant boundary; a low-privilege user in Org A who learns or guesses an ID from Org B can act on Org B's data, and a loader-only restriction on personal-workspace bookings is bypassable via a crafted POST. No public exploit identified at time of analysis and the issue is not on CISA KEV, but the flaw is straightforward to abuse once a foreign ID is known.