Shelf-nu vulnerabilities
We track 2 vulnerabilities in Shelf-nu products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on September 11, 2026.
2vulnerabilities
0critical
2high
0exploited
7.1average CVSS score
Latest Shelf-nu vulnerabilities
- 7.1 High severity
shelf.nu: Server-Side Request Forgery
Shelf is a platform for tracking physical assets. Prior to version 1.20.3, authenticated users with the `asset:import` permission can trigger server-side HTTP requests to attacker-controlled URLs through the Asset CSV Content Import feature. The `imageUrl` val
- 7.1 High severity
shelf.nu: Incorrect Authorization
Shelf is a platform for tracking physical assets. Shelf is multi-tenant; data is isolated per organization (workspace). Prior to version 1.20.2, several endpoints accepted entity IDs from request input and `connect`-ed / read / updated them without verifying t