CVE-2026-117606
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
NexoPOS through 6.3.0 contains a missing authorization vulnerability that allows authenticated cashiers to manipulate other cashiers' register sessions because CashRegistersService never compares used_by with the user. Attackers holding the default nexopos.use.registers permission can submit closing, cash-in, or cash-out actions to POST /api/cash-registers/{action}/{register} to force-close sessions or alter balances.
Risk Assessment
Cashiers can improperly close other cashiers' sessions or modify balances, leading to financial discrepancies and potential fraud. The organization may suffer financial losses and loss of sales data integrity.
Recommendation
Update NexoPOS to a version later than 6.3.0 if available, or implement an authorization check comparing used_by with the current user. Restrict the nexopos.use.registers permission to essential staff and monitor unusual register actions.
Other vulnerabilities in NexoPOS
See all- CVE-2026-111637Medium
NexoPOS through 6.2.4 contains a missing authentication vulnerability that allows unauthenticated attackers to read accounting transaction records via GET /api/fields/{resource}/{identifier}. Attackers can request transaction field classes like ns.entity-transaction with sequential ids to retrieve names, values, account ids, and descriptions without nexopos.read.transactions permission.
- CVE-2026-107092Critical
NexoPOS v6.2.4 is vulnerable to Directory Traversal via the api/update endpoint. This may allow an attacker to access files outside the intended directory.
Original NVD description (English source)
NexoPOS through 6.3.0 contains a missing authorization vulnerability that allows authenticated cashiers to manipulate other cashiers' register sessions because CashRegistersService never compares used_by with the user. Attackers holding the default nexopos.use.registers permission can submit closing, cash-in, or cash-out actions to POST /api/cash-registers/{action}/{register} to force-close sessions or alter balances.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS