CVE-2026-109080
6.5MediumPublished 12 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- High impact on confidentiality
- Weakness
- CWE-89
Impact
Authenticated users can read license plate recognition records across other customer organizations. Attackers only need network access and a standard user account on the hosted platform.
Root cause
Improper sanitization of user-supplied license plate values in the bulk search feature leads to SQL injection.
Affected systems
Flock Night Shift hosted service prior to the 2026-08-12 patch.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Fix & remediation
No action required. Flock patched the hosted SaaS service on 2026-08-12.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
SQL injection in the bulk license plate search of the Flock Night Shift hosted service allowed an authenticated user to read other customer organizations' data, including license plate recognition records, via a crafted license plate value. Data could not be modified. Flock identified the issue through internal security review and remediated it on 2026-08-12; no customer action is required.