CVE-2026-50890: Bernd Bestel grocy v4

Synopsis

SQL injection in Bernd Bestel grocy v4.6.0 allows an unauthenticated attacker to manipulate database queries through the product-group parameter at the /stockreports/spendings endpoint. The vulnerability is reachable over the network with no authentication required and no user interaction needed. Successful exploitation gives the attacker direct read and write access to the underlying database, enabling theft of sensitive records and potential data tampering. No fix version has been published; HarborGuard tracks the upstream advisory and will make a patched rebuild available the moment a fix is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network, so an attacker must be able to reach the grocy web service via HTTP/HTTPS.

• AuthenticationNot required

  No account or session credential is needed; the injection point is accessible to anonymous requests.

• Victim interactionNot required

  The attacker sends a crafted request directly to the server; no user action or social engineering is involved.

• Attack complexityDetail

  Exploitation is reliable and condition-free, requiring only a crafted SQL payload in the product-group parameter with no race conditions or environmental dependencies.

Blast Radius

• Reads sensitive database records including user data, inventory entries, and any credentials or tokens stored in the grocy database.
• Modifies or deletes persisted database rows, enabling corruption of stock and spending records.
• May expose configuration values or secrets stored in database tables, widening the attack surface beyond grocy itself.
• Depending on database server configuration, may allow file-system reads or further lateral movement through the host environment.