The vulnerability is a SQL injection flaw found in the bulk license plate search of the hosted Night Shift service. An authenticated user can supply a specially crafted license plate value that causes the query to execute arbitrary SQL. Various databases are then queried and the results include license‑plate recognition records from other tenant organizations. The attacker can read, but not modify, this data. The weakness aligns with CWE‑89.

All instances of the Flock Night Shift service that were deployed prior to the remediation date of 2026‑08‑12 are affected. The product is Flock Night Shift, hosted by the vendor. The affected versions are those in use before the vendor's update. The vendor has released a patch that addresses the issue. No action is required for customers using the hosted service and the vendor confirmed the fix.

The CVSS score of 7.1 indicates a medium‑to‑high impact with the ability for an authenticated attacker to read sensitive data. The EPSS is not available, so the exploitation likelihood cannot be quantified, and the vulnerability has not been listed in CISA KEV. The attack vector appears to be through the bulk search endpoint, requiring valid credentials. Therefore, the risk is moderate; monitoring and ensuring that only authorized users can invoke this functionality is essential.