CVE-2026-111637 — NexoPOS through 6.2.4 Unauthenticated Transaction Disclosure via /api/fields Endpoint
NexoPOS through 6.2.4 contains a missing authentication vulnerability that allows unauthenticated attackers to read accounting transaction records via GET /api/fields/{resource}…
Published: 2026-10-16 · CVSS: 6.9 · CVSS 4.0
NexoPOS through 6.2.4 contains a missing authentication vulnerability that allows unauthenticated attackers to read accounting transaction records via GET /api/fields/{resource}/{identifier}. Attackers can request transaction field classes like ns.entity-transaction with sequential ids to retrieve names, values, account ids, and descriptions without nexopos.read.transactions permission.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7