CVE-2026-117606
NexoPOS through 6.3.0 Missing Authorization via Cash Register Session Actions
CVSS Score
5.4
EPSS Score
0.0%
EPSS Percentile
0th
NexoPOS through 6.3.0 contains a missing authorization vulnerability that allows authenticated cashiers to manipulate other cashiers' register sessions because CashRegistersService never compares used_by with the user. Attackers holding the default nexopos.use.registers permission can submit closing, cash-in, or cash-out actions to POST /api/cash-registers/{action}/{register} to force-close sessions or alter balances.
| CWE | CWE-639 |
| Vendor | blair2004 |
| Product | nexopos |
| Published | Oct 28, 2026 |
Stay Ahead of the Next One
Get instant alerts for blair2004 nexopos
Be the first to know when new medium vulnerabilities affecting blair2004 nexopos are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
Low
Affected Versions
Blair2004 / NexoPOS
0 ≤ 6.3.0
References
github.com: https://github.com/Blair2004/NexoPOS/issues/2668 github.com: https://github.com/Blair2004/NexoPOS/pull/2673 github.com: https://github.com/Blair2004/NexoPOS/blob/1e9b2e272026e176cba354534678a111b1832ce6/app/Services/CashRegistersService.php#L53-L92 github.com: https://github.com/Blair2004/NexoPOS vulncheck.com: https://www.vulncheck.com/advisories/nexopos-through-6.3.0-missing-authorization-via-cash-register-session-actions
Credits
hieuPenguinnn