SQL Injection Vulnerability in Flock Night Shift Hosted Service
CVE-2026-109080

7.1HIGH

Key Information:

Vendor

Flock

Status
Night Shift
Vendor
CVE Published:
12 October 2026

What is CVE-2026-109080?

An SQL injection vulnerability exists in the bulk license plate search feature of the Flock Night Shift hosted service. This flaw allows authenticated users to exploit the system by crafting a specific license plate search input, which can result in unauthorized access to other customer organizations' data, including sensitive license plate recognition records. While the vulnerability does not allow for data modification, it poses a significant risk of data exposure. Flock has addressed this issue through an internal security review and released a fix on August 12, 2026, ensuring that no customer action is required.

Affected Version(s)

Night Shift 0 <= 2026-08-12

References

https://www.flocksafety.com/legal/security-advisories
vendor-advisory

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.