CVE-2026-109080
Received Received - Intake

SQL Injection in Flock Night Shift Hosted Service

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: 12dd0b25-a5e8-4486-84b1-59c4a6ebd552

Description
SQL injection in the bulk license plate search of the Flock Night Shift hosted service allowed an authenticated user to read other customer organizations' data, including license plate recognition records, via a crafted license plate value. Data could not be modified. Flock identified the issue through internal security review and remediated it on 2026-08-12; no customer action is required.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-109080
EUVD
EUVD-2026-97239

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Flock Night Shift 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a SQL injection vulnerability in the bulk license plate search feature of the Flock Night Shift hosted service. An authenticated user could exploit it by entering a specially crafted license plate value to read data belonging to other customer organizations. The affected data includes license plate recognition records. The vulnerability did not allow modification of data.

Detection Guidance

This vulnerability was specific to Flock Night Shift's bulk license plate search feature and has already been remediated by the vendor. No detection commands are applicable as it was an internal service issue.

Impact Analysis

If you are an authenticated user of the Flock Night Shift service, this vulnerability could allow you to access sensitive data from other organizations, such as their license plate recognition records. This exposes confidential information and violates data privacy.

Compliance Impact

This vulnerability likely violates data protection regulations such as GDPR and HIPAA by enabling unauthorized access to sensitive personal data. It could result in non-compliance with requirements for data confidentiality, access controls, and breach notification.

Mitigation Strategies

No action is required as Flock has already remediated the issue on 2026-08-12. The vulnerability was addressed through an internal security review and patch.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109080. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart