Skip to content
Heist/ feed
High

SQL injection in Night Shift bulk license plate search allows cross-organization data access

Type: advisorySource: Official CVE List1 source record

SQL injection in the bulk license plate search of the Flock Night Shift hosted service allowed an authenticated user to read other customer organizations' data, including license plate recognition records, via a crafted license plate value. Data could not be modified. Flock identified the issue through internal security review and remediated it on 2026-08-12; no customer action is required.

Announced Source revision 1
Original source ↗

CVE-2026-109080

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-109080

Night Shift

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "vendor": "Flock",
    "product": "Night Shift",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "versionType": "custom",
        "lessThanOrEqual": "2026-08-12"
      }
    ],
    "defaultStatus": "unaffected"
  }
]
Related CVEs
CVE-2026-109080

Source reference: /cveMetadata/cveId

Publisher severity

high

Source reference: /containers/cna/metrics

Event
#29968 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement