CVE-2026-47697 is an incorrect authorization vulnerability (CWE-863) in Shelf-nu, a multi-tenant asset tracking platform. Before version 1.20.2, certain API endpoints accepted entity IDs from user input and performed connect/read/update operations without verifying that these IDs belonged to the authenticated user's organization. This flaw allowed an authenticated user in one organization to act on data belonging to another organization, resulting in a cross-tenant Insecure Direct Object Reference (IDOR). Additionally, a loader-only restriction on personal-workspace bookings was bypassable via a crafted POST request. The issue is patched in version 1.20.2. There are no known workarounds or exploits in the wild.

An authenticated user can access or modify data belonging to other organizations within the Shelf-nu platform, violating data isolation guarantees in this multi-tenant environment. This leads to unauthorized data disclosure and limited unauthorized modification (integrity impact is low). Availability is not affected. The CVSS 3.1 base score is 7.1 (high severity) reflecting network attack vector, low attack complexity, and required privileges.

Upgrade to Shelf-nu version 1.20.2 or later, which patches the authorization checks to ensure entity IDs belong to the caller's organization. No other workarounds are available. Since this is not a cloud service, remediation depends on applying the vendor's patch.