CVE-2026-50890

Name of the Vulnerable Software and Affected Versions grocy version 4.6.0

Description SQL injection occurs at the '/stockreports/spendings' endpoint through the product-group parameter. This allows attackers to access sensitive database information by using a crafted SQL statement. SQL injection is a type of flaw where an attacker can interfere with the queries that an application makes to its database.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the '/stockreports/spendings' endpoint or avoid using the product-group parameter.