CVE-2026-109080: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in Flock Night Shift

This vulnerability involves improper neutralization of special elements in an SQL command (CWE-89) within the bulk license plate search functionality of Flock Night Shift. An authenticated user could craft a malicious license plate value to perform SQL injection, enabling unauthorized reading of other customers' license plate recognition data. The issue was discovered internally and fixed by Flock on 2026-08-12. The vulnerability has a CVSS 4.0 score of 7.1, indicating high severity, with network attack vector, low attack complexity, no privileges required beyond authentication, and high confidentiality impact.

An attacker with valid authentication could exploit this vulnerability to read sensitive license plate recognition records from other customer organizations, potentially exposing confidential data. However, the vulnerability does not permit modification or deletion of data. There are no known exploits in the wild.

Flock has remediated this vulnerability as of 2026-08-12. Since the service is not cloud-hosted and the vendor has provided an official fix, users should ensure they are running versions released after this date. No additional customer action is required as per the vendor advisory.