Live › vulnerability › CVE-2026-111637
Go to dashboardNexoPOS through 6.2.4 exposes the GET /api/fields/{resource}/{identifier} endpoint without authentication. An unauthenticated attacker can iterate sequential ids to read accounting transaction names, values, account ids and descriptions.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
NexoPOS installations at version 6.2.4 or earlier that are reachable from the internet or an untrusted network. The endpoint is exposed to anyone who can send an HTTP request to the instance, with no account needed. Installations behind a VPN or with the path blocked at the proxy are lower risk.
No product ranges from the sources yet.
curl -i http://<your-host>/api/fields/ns.entity-transaction/1 without credentials and see whether a 200 response with transaction data comes back6.2.46.2.4 (fixed version unknown from the sources)/api/fields/ at the reverse proxy or web serverEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
NexoPOS through 6.2.4 contains a missing authentication vulnerability that allows unauthenticated attackers to read accounting transaction records via GET /api/fields/{resource}/{identifier}. Attackers can request transaction field classes like ns.entity-transaction with sequential ids to retrieve names, values, account ids, and descriptions without nexopos.read.transactions permission.
This page as .md · .json · in your agent: get_signal("CVE-2026-111637")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.