CVE-2026-109080

The Flock Night Shift hosted service is vulnerable to a SQL injection flaw within its bulk license plate search functionality. An authenticated user could exploit this by providing a crafted license plate value to access and read data belonging to other customer organizations, specifically licens...

CVE-2026-109080 SQL injection in Night Shift bulk license plate search allows cross-organization data access

SQL injection in the bulk license plate search of the Flock Night Shift hosted service allowed an authenticated user to read other customer organizations' data, including license plate recognition records, via a crafted license plate value. Data could not be modified. Flock identified the issue...

Mail.ru: Cross-organization data access in city-mobil.ru

A legitimate partner's superuser account could have access to information of driver belonging to different partner, including passport and driving license data. Combined Improrer Access + IDOR It was possible to get access to passport, drive license any taxi driver. As well as changed settings...