Executive brief
Shelf, a multi-tenant platform for tracking physical assets, contained a security flaw that allowed users from one organization to access or modify data belonging to another organization. By using a known identification number from a different workspace, an authenticated user could view asset titles, link foreign assets to their own bookings, or bypass certain workspace restrictions. While the vulnerability requires knowledge of specific, hard-to-guess IDs, it poses a risk to data privacy and the integrity of asset records across different customer accounts.
Technical details
A cross-tenant Insecure Direct Object Reference (IDOR) vulnerability existed in Shelf due to insufficient authorization checks at the data layer. Several endpoints accepted entity IDs (such as assets, tags, or custodians) and performed read/update operations without verifying that the IDs were associated with the caller's organizationId. An authenticated attacker with knowledge of a target's 25-character CUID could attach foreign assets to bookings, read booking statuses, or bypass personal-workspace restrictions. The issue was remediated in version 1.20.2 by implementing transaction-aware organization scoping for all user-supplied IDs and introducing a custom ESLint rule to prevent future regressions in Prisma queries.
Affected products
- Shelf-nu shelf.nu < 1.20.2
Timeline
- 2026-05-19: advisory: Original GitHub security advisory published
- 2026-07-21: disclosed: CVE published to NVD
- 2026-07-21: patched: Version 1.20.2 released to address the vulnerability