Vulnerability · Published Oct 12, 2026 · Assigned by flock

CVE-2026-109080SQL injection in Night Shift bulk license plate search allows cross-organization data access

Medium 6.5

In plain English

A medium-severity SQL injection in Night Shift from Flock. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 12% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.2%top 88.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

SQL injection in the bulk license plate search of the Flock Night Shift hosted service allowed an authenticated user to read other customer organizations' data, including license plate recognition records, via a crafted license plate value. Data could not be modified. Flock identified the issue through internal security review and remediated it on 2026-08-12; no customer action is required.

Affected products (as reported)

Vendor	Product	Versions
Flock	Night Shift	0 – through 2026-08-12

Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

Flock Security Advisory vendor-advisory