Live › vulnerability › CVE-2026-117606
Go to dashboardNexoPOS through 6.3.0 does not check whether a register session belongs to the requesting cashier, so any authenticated cashier with the default register permission can close or change another cashier's session. An attacker can force-close sessions and alter cash balances through the cash-registers API.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 03:31 UTC. All times on this page are UTC.
Deployments of NexoPOS 6.3.0 and earlier where cashiers have accounts and the default register permission. The flaw requires a valid cashier login, so teams with no multi-user cashier accounts face little exposure. Single-operator installs are unlikely to be affected.
No product ranges from the sources yet.
6.3.0 or earlier.nexopos.use.registers permission, which is granted by default.Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
NexoPOS through 6.3.0 contains a missing authorization vulnerability that allows authenticated cashiers to manipulate other cashiers' register sessions because CashRegistersService never compares used_by with the user. Attackers holding the default nexopos.use.registers permission can submit closing, cash-in, or cash-out actions to POST /api/cash-registers/{action}/{register} to force-close sessions or alter balances.
This page as .md · .json · in your agent: get_signal("CVE-2026-117606")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.