CVE-2026-111637
MediumCVSS 5.3Summary
NexoPOS through 6.2.4 contains a missing authentication vulnerability that allows unauthenticated attackers to read accounting transaction records via GET /api/fields/{resource}/{identifier}. Attackers can request transaction field classes like ns.entity-transaction with sequential ids to retrieve names, values, account ids, and descriptions without nexopos.read.transactions permission.
Risk Assessment
An unauthenticated attacker can access accounting transaction records, leading to a breach of financial data confidentiality. The organization may face legal consequences and loss of customer trust.
Recommendation
Update NexoPOS to a version newer than 6.2.4 if available, or implement authentication and authorization for the /api/fields/{resource}/{identifier} endpoint. Restrict access to this endpoint and monitor for unusual requests.
Other vulnerabilities in NexoPOS
See all- CVE-2026-107092Critical
NexoPOS v6.2.4 is vulnerable to Directory Traversal via the api/update endpoint. This may allow an attacker to access files outside the intended directory.
- CVE-2026-117606Medium
NexoPOS through 6.3.0 contains a missing authorization vulnerability that allows authenticated cashiers to manipulate other cashiers' register sessions because CashRegistersService never compares used_by with the user. Attackers holding the default nexopos.use.registers permission can submit closing, cash-in, or cash-out actions to POST /api/cash-registers/{action}/{register} to force-close sessions or alter balances.
Original NVD description (English source)
NexoPOS through 6.2.4 contains a missing authentication vulnerability that allows unauthenticated attackers to read accounting transaction records via GET /api/fields/{resource}/{identifier}. Attackers can request transaction field classes like ns.entity-transaction with sequential ids to retrieve names, values, account ids, and descriptions without nexopos.read.transactions permission.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS