Missing Authentication in NexoPOS Allows Data Access Without Permissions
CVE-2026-111637

6.9MEDIUM

Key Information:

Vendor

Blair2004

Status
Nexopos
Vendor
CVE Published:
16 October 2026

What is CVE-2026-111637?

NexoPOS versions up to 6.2.4 suffer from a missing authentication flaw that enables unauthorized users to access sensitive accounting transaction information. By sending GET requests to the /api/fields/{resource}/{identifier} endpoint, attackers can retrieve sensitive transaction details, such as names, values, account ids, and descriptions, without the necessary permissions. This vulnerability poses a significant risk, allowing attackers to exploit the system for unauthorized data access.

Affected Version(s)

NexoPOS 0 <= 6.2.4

References

https://hackmd.io/@hieuPenguinnn/nexopos-fields-endpoint-...
third-party-advisory
https://github.com/Blair2004/NexoPOS/blob/v6.2.4/routes/a...
technical-description
https://github.com/Blair2004/NexoPOS/blob/v6.2.4/app/Prov...
technical-description

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

hieuPenguinnn
.