Critical severity9.8NVD Advisory· Published Jun 15, 2026· Updated Jun 16, 2026

CVE-2026-50890

Description

Bernd Bestel grocy v4.6.0 was discovered to contain a SQL injection vulnerability in the product-group parameter at /stockreports/spendings. This vulnerability allows attackers to access sensitive database information via a crafted SQL statement.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Grocy Project/Grocyinferred
Range: = 4.6.0
Bernd Bestel/grocyllm-fuzzy
Range: = 4.6.0

Patches

Vulnerability mechanics

References

gist.github.com/pyuysig/92e631298ec28d3e6967ad1f2038e75dnvd

News mentions

No linked articles in our index yet.

cvss	0.637
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000