Missing Authorization Vulnerability in NexoPOS Cash Register Sessions

CVE-2026-117606

What is CVE-2026-117606?

The NexoPOS software, specifically versions up to 6.3.0, contains a vulnerability that allows authenticated cashiers to manipulate other cashiers' register sessions due to a failure in verifying user authorization. The CashRegistersService does not validate the user linked to an active register session, enabling attackers with the default 'nexopos.use.registers' permission to execute unauthorized actions. This includes the ability to submit requests to force-close register sessions or alter cash balances, posing significant risks to the integrity of financial transactions.

References