Shelf is a platform for tracking physical assets. A SQL injection flaw (CWE‑89) involving unvalidated input (CWE‑20) was discovered in the sortBy query parameter on the /assets route, which allows any authenticated user—regardless of role—to execute arbitrary SQL statements. The attacker can read data from any database table, including sensitive data belonging to other organizations, thereby compromising confidentiality.

The vulnerability exists in Shelf versions from 1.12 up through 1.20.0. It affects installations of the Shelf‑nu product distributed by the Shelf‑nu vendor. The defect was fixed in the 1.20.1 release, so any deployment on 1.20.1 or later is not susceptible.

The CVSS score of 6.5 indicates a moderate severity, and no EPSS score is available, which limits insight into real‑world exploitation probability. Because the flaw requires authentication, an attacker needs an active user session, but no role restrictions prevent access to all tables. The vulnerability is not listed in CISA’s KEV catalog, suggesting no widespread exploitation has been confirmed, yet it still presents a significant confidentiality risk for authenticated users.