CVE-2026-47697

Received Received - Intake

Authentication Bypass in Shelf Platform

Publication date: 2026-07-21

Last updated on: 2026-07-21

Assigner: GitHub, Inc.

Description

Shelf is a platform for tracking physical assets. Shelf is multi-tenant; data is isolated per organization (workspace). Prior to version 1.20.2, several endpoints accepted entity IDs from request input and `connect`-ed / read / updated them without verifying the IDs belonged to the caller's organization. An authenticated user in Org A who knew or obtained an ID belonging to Org B could act on Org B's data across organization boundaries (a cross-tenant IDOR). A loader-only restriction on personal-workspace bookings was also bypassable via a crafted POST. Version 1.20.2 patches the issue. No known workarounds are available.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-21

Last Modified

2026-07-21

Generated

2026-07-22

AI Q&A

2026-07-22

EPSS Evaluated

N/A

NVD

CVE-2026-47697

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

This vulnerability is an Insecure Direct Object Reference (IDOR) in the Shelf platform, which tracks physical assets. It allows authenticated users to access or modify data belonging to other organizations by manipulating entity IDs in requests. The issue affects versions before 1.20.2 and was patched in 1.20.2.

Impact Analysis

If you use Shelf, an attacker in your organization could access or alter data belonging to another organization by exploiting this flaw. This could lead to unauthorized data exposure, modification, or deletion across tenant boundaries.

Compliance Impact

This vulnerability could violate compliance requirements like GDPR (data protection) or HIPAA (health data privacy) by enabling unauthorized access to sensitive data across organizations. It undermines data isolation and tenant boundaries required by these regulations.

Mitigation Strategies

Upgrade Shelf to version 1.20.2 or later to patch the vulnerability. Ensure all users are authenticated and verify entity IDs belong to their organization before processing requests.

Hi! I’m here to help you understand CVE-2026-47697. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70