Restro POS CVE-2026-116461

Exploitation requires an authenticated session on the Restro POS application (CVSS PR:L - low-privileged account), after which the attacker sends a request to the /sale-invoice/ endpoint and tampers with the productUnitSalePrice argument to induce a business-logic error. Limiting factors: authentication is required (not a default-open remote flaw), no user interaction is needed, and impact is confined to low integrity (price/invoice manipulation) with no confidentiality or availability effect. No special non-default configuration is identified in the available sources; the exact server-side trigger for the business-logic error is not described in the available sources.

This is a low-severity, low-priority issue, and the signals are internally consistent in pointing that way. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N) scores only 2.1: network-reachable and low-complexity, but it requires authentication (PR:L) and yields only low integrity impact with no confidentiality and no availability impact. CWE-840 (business logic errors) and the manipulation of the productUnitSalePrice argument indicate a price/logic tampering flaw rather than code execution or data exposure. No EPSS score and no KEV listing were provided; the vuln.today decision label is 'monitor', and the exploit maturity is E:P (proof-of-concept), not active exploitation. A public PoC reference exists (a GitHub issue) but it is not verified as working exploit code, so this should not be conflated with confirmed exploitability or in-the-wild use. One cross-source inconsistency is worth noting: the input Tags include 'Information Disclosure', yet the CVSS vector sets VC:N (no confidentiality impact) and the only impact is VI:L (integrity), so the 'Information Disclosure' framing appears to conflict with both the vector and the business-logic nature of the flaw - treat it as an integrity/price-manipulation issue, not disclosure. The vendor was contacted but did not respond, so no authoritative confirmation or patch exists. Net: a genuine but minor authenticated integrity bug, appropriately rated 'monitor', not an emergency.

An authenticated low-privileged user of the Restro POS application sends a request to the /sale-invoice/ endpoint with a manipulated productUnitSalePrice value, causing a business-logic error that alters the effective unit sale price on an invoice. A public PoC reference exists (a GitHub issue) but it is not verified as working exploit code. Because the CVSS vector is PR:L with only low integrity impact, the realistic outcome is limited price/invoice tampering by someone who already has account access, not full compromise.