CVE-2026-111637

NexoPOS through 6.2.4 contains a missing authentication vulnerability that allows unauthenticated attackers to read accounting transaction records via GET /api/fields/{resource}/{identifier}. Attackers can request transaction field classes like ns.entity-transaction with sequential ids to retrieve names, values, account ids, and descriptions without nexopos.read.transactions permission.

An unauthenticated attacker can access accounting transaction records, leading to a breach of financial data confidentiality. The organization may face legal consequences and loss of customer trust.

Update NexoPOS to a version newer than 6.2.4 if available, or implement authentication and authorization for the /api/fields/{resource}/{identifier} endpoint. Restrict access to this endpoint and monitor for unusual requests.