CVE-2026-105039
CriticalCVSS 9.6Summary
EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 do not check user roles on administrative APIs. Any authenticated low-privilege user can retrieve AI provider keys and change configuration and object-store contents.
Risk Assessment
A low-privilege attacker can access sensitive API keys and modify configuration, potentially leading to unauthorized access and data breaches.
Recommendation
Update station-middleware to a version later than 1.8.2. In the meantime, restrict access to administrative APIs to authorized roles only.
Other vulnerabilities in EnergizeLab station-middleware
Original NVD description (English source)
EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 do not check user roles on administrative APIs. Any authenticated low-privilege user can retrieve AI provider keys and change configuration and object-store contents.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS