{"id":"CVE-2026-111637","kind":"vulnerability","aliases":["CVE-2026-111637"],"related":[],"title":"NexoPOS: unauthenticated read of accounting transaction records via API","description":"NexoPOS through 6.2.4 contains a missing authentication vulnerability that allows unauthenticated attackers to read accounting transaction records via GET /api/fields/{resource}/{identifier}. Attackers can request transaction field classes like ns.entity-transaction with sequential ids to retrieve names, values, account ids, and descriptions without nexopos.read.transactions permission.","summary":"NexoPOS through 6.2.4 exposes the GET /api/fields/{resource}/{identifier} endpoint without authentication. An unauthenticated attacker can iterate sequential ids to read accounting transaction names, values, account ids and descriptions.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["accounting","nexopos","package","php","self-hosted"],"not_affected_if":["not-internet-exposed","version-6.2.5-or-later"],"how_to_check":"- Run `curl -i http://<your-host>/api/fields/ns.entity-transaction/1` without credentials and see whether a 200 response with transaction data comes back\n- Check the installed NexoPOS version against `6.2.4`","fix":"- Upgrade NexoPOS to a release later than `6.2.4` (fixed version unknown from the sources)\n- Until patched, block unauthenticated access to `/api/fields/` at the reverse proxy or web server","status":"open","published_at":"2026-10-16T18:17:44+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","triaged_at":"2026-10-25T03:42:26+00:00","updated_at":"2026-10-25T03:42:26+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T03:42:26Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade NexoPOS to a release later than `6.2.4` (fixed version unknown from the sources)\n- Until patched, block unauthenticated access to `/api/fields/` at the reverse proxy or web server","reach":"internet","title":"NexoPOS: unauthenticated read of accounting transaction records via API","impact":"medium","summary":"NexoPOS through 6.2.4 exposes the GET /api/fields/{resource}/{identifier} endpoint without authentication. An unauthenticated attacker can iterate sequential ids to read accounting transaction names, values, account ids and descriptions.","category":"package","nicknames":[],"who_cares":["nexopos","php","self-hosted","accounting"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker reads accounting transaction records without logging in","analyst_note":"Confirm the fixed NexoPOS version and whether the endpoint is patched; the NVD entry is the only source and gives no fix or advisory link.","how_to_check":"- Run `curl -i http://<your-host>/api/fields/ns.entity-transaction/1` without credentials and see whether a 200 response with transaction data comes back\n- Check the installed NexoPOS version against `6.2.4`","needs_analyst":true,"not_affected_if":["version-6.2.5-or-later","not-internet-exposed"],"who_is_affected":"NexoPOS installations at version 6.2.4 or earlier that are reachable from the internet or an untrusted network. The endpoint is exposed to anyone who can send an HTTP request to the instance, with no account needed. Installations behind a VPN or with the path blocked at the proxy are lower risk.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000643,"input_tokens":3350,"output_tokens":617,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-111637':12A,15A '-2026':11A,14A '/api/fields':29B,71C '6.2.4':25B,54C 'account':5A,16B,44B,48B,66C,90C 'allow':61C 'api':9A 'attack':37B,63C,74C 'authent':34B,58C 'class':79C 'contain':55C 'cve':10A,13A 'descript':51B,93C 'endpoint':32B 'expos':26B 'field':78C 'get':28B,70C 'host':22B 'id':41B,49B,85C,91C 'identifi':31B,73C 'iter':39B 'like':80C 'miss':57C 'name':46B,88C 'nexopo':1A,17B,23B,52C 'nexopos.read.transactions':95C 'ns.entity':81C 'packag':18B 'permiss':96C 'php':19B 'read':3A,43B,65C 'record':7A,68C 'request':76C 'resourc':30B,72C 'retriev':87C 'self':21B 'self-host':20B 'sequenti':40B,84C 'transact':6A,45B,67C,77C,82C 'unauthent':2A,36B,62C 'valu':47B,89C 'via':8A,69C 'vulner':59C 'without':33B,94C","nicknames":[],"mitigations":[],"who_affected":"NexoPOS installations at version 6.2.4 or earlier that are reachable from the internet or an untrusted network. The endpoint is exposed to anyone who can send an HTTP request to the instance, with no account needed. Installations behind a VPN or with the path blocked at the proxy are lower risk.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T18:17:44+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111637","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111637","severity":null,"published_at":"2026-10-16T18:17:44+00:00","modified_at":"2026-10-16T20:17:21+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}