CVE-2026-50890

Vulnerability

A SQL injection vulnerability exists in Bernd Bestel grocy v4.6.0 within the stock spending report endpoint at /stockreports/spendings. The product-group query parameter is concatenated directly into the SQL WHERE clause when group-by=product is specified and the parameter value is neither all nor ungrouped [1]. No validation or parameterized binding is used, allowing arbitrary SQL to be injected. The database backend is SQLite.

Exploitation

An attacker must have a valid authenticated session to grocy v4.6.0 [1]. The attack is performed by sending a crafted product-group value in a request to /stockreports/spendings?group-by=product that terminates the intended SQL expression and appends additional SQL statements, such as sqlite_version() or queries against pragma_database_list [1]. The attacker observes the report output or error messages to confirm successful injection. No user interaction beyond the attacker's own actions is required.

Impact

Successful exploitation results in authenticated SQL injection, allowing the attacker to read or alter data accessible to the application's SQLite connection, such as user credentials, product data, or configuration [1]. The vulnerability does not directly lead to remote code execution in the tested configuration, as the custom include code execution path was not confirmed due to file-write limitations [1]. The attacker gains access to sensitive database information, potentially compromising confidentiality and integrity of the application.

Mitigation

Bernd Bestel grocy v4.6.0 is the confirmed affected version [1]. As of the publication date (2026-06-15) [CVE header], no official patch or fixed version has been released in the available references. Users should monitor the grocy project for updates and consider input sanitization or parameterized queries as a workaround until a fix is applied [1].