CVE-2026-50890: grocy v4.6.0 SQL Injection Vulnerability

CVE-2026-50890 Overview

CVE-2026-50890 is a SQL injection vulnerability in Bernd Bestel grocy v4.6.0, an open-source ERP system for home groceries and household management. The flaw resides in the product-group parameter of the /stockreports/spendings endpoint. Unauthenticated attackers can submit crafted SQL statements through this parameter to access sensitive database contents. The issue is tracked under CWE-89: Improper Neutralization of Special Elements used in an SQL Command.

Critical Impact
Remote, unauthenticated attackers can extract, modify, or destroy data stored in the grocy database through a single crafted HTTP request to the spendings stock report endpoint.

Affected Products

Bernd Bestel grocy v4.6.0
The /stockreports/spendings endpoint handling the product-group parameter
Deployments exposing the grocy web interface to untrusted networks

Discovery Timeline

2026-06-15 - CVE-2026-50890 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-50890

Vulnerability Analysis

The vulnerability exists in the spendings stock report feature of grocy. The application accepts a product-group query parameter and concatenates the value directly into a backend SQL statement without parameterization or input sanitization. Because the endpoint accepts requests over the network with no privileges and no user interaction, an attacker can deliver malicious SQL payloads through standard HTTP tooling.

Successful exploitation breaks confidentiality, integrity, and availability of the underlying SQLite or MySQL database that grocy uses. Attackers can enumerate schemas, exfiltrate user credentials and household records, alter inventory data, or drop tables. The publicly available proof-of-concept demonstrates extraction of database contents using UNION-based and boolean-based injection techniques. See the GitHub Gist PoC Example for technical details.

Root Cause

The root cause is improper neutralization of special characters in the product-group request parameter [CWE-89]. The query construction logic concatenates user input into a SQL string instead of binding it as a parameter, allowing the attacker-controlled value to escape its intended context and append arbitrary SQL clauses.

Attack Vector

The attack vector is network-based and requires no authentication. An attacker sends a single HTTP GET request to /stockreports/spendings with a malicious product-group value containing SQL syntax such as UNION SELECT clauses or boolean predicates. The server returns query results or differential responses that leak database content.

No verified code examples are available for this vulnerability. Refer to the GitHub Gist PoC Example for the published proof-of-concept payload.

Detection Methods for CVE-2026-50890

Indicators of Compromise

HTTP requests to /stockreports/spendings containing SQL keywords such as UNION, SELECT, SLEEP, --, or 0x in the product-group parameter
Anomalous response sizes or response times for spendings report requests, indicating boolean or time-based injection
Database error strings (SQLite or MySQL) appearing in web server logs tied to the spendings endpoint
Unexpected outbound queries against sqlite_master, information_schema.tables, or grocy user tables

Detection Strategies

Deploy web application firewall signatures that flag SQL metacharacters in the product-group query parameter
Enable SQL query logging on the grocy database and alert on queries referencing system catalogs from the web application user
Correlate web access logs with database audit logs to identify malformed product-group values producing successful query execution

Monitoring Recommendations

Continuously monitor access logs for repeated requests to /stockreports/spendings from a single source within short time windows
Alert on HTTP 500 responses or PHP/SQL stack traces returned from grocy endpoints
Track authentication state of clients accessing stock report endpoints and flag unauthenticated traffic from external networks

How to Mitigate CVE-2026-50890

Immediate Actions Required

Restrict access to the grocy instance to trusted networks or VPN clients until a fixed version is available
Place the application behind a reverse proxy with a WAF ruleset that blocks SQL injection patterns on the product-group parameter
Audit the grocy database for unauthorized reads, modifications, or new administrative accounts
Rotate any credentials, API tokens, or session secrets stored within the grocy database

Patch Information

No vendor advisory or patched release was referenced in the NVD entry at the time of publication. Operators should monitor the grocy project repository for an updated release that supersedes v4.6.0 and apply it immediately upon availability.

Workarounds

Disable or remove access to the /stockreports/spendings route via reverse proxy rules until a patch is applied
Enforce authentication at the proxy layer using HTTP basic auth or an identity-aware proxy
Run grocy under a database account with read-only privileges where feasible to limit injection impact
Apply input validation at the proxy to reject product-group values that do not match a strict allowlist of numeric identifiers

bash

# Example nginx rule to block SQL metacharacters in the product-group parameter
location /stockreports/spendings {
    if ($arg_product_group ~* "('|\"|;|--|union|select|sleep|0x)") {
        return 403;
    }
    proxy_pass http://grocy_backend;
}