NexoPOS CVE-2026-117606

Exploitation requires an authenticated NexoPOS account holding the default nexopos.use.registers permission (granted to the built-in store cashier role), and a target register session that was opened by a different cashier and is currently open. The attacker then submits a closing, cash-in, or cash-out action to POST /api/cash-registers/{action}/{register} for a register whose used_by value is not their own user ID. Limiting factors: a valid low-privileged cashier credential is required (not remote-unauthenticated), impact is confined to other users' open register sessions within the same installation, and installations with only a single cashier or without the default register permission granted are not meaningfully exposed. Updating to the patched code (PR #2673), which enforces register ownership, is the vendor-provided fix.

This is a medium-severity authorization flaw (CVSS 4.0 base 5.3, CWE-639) whose real-world risk is moderate and bounded. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L) is internally consistent with the description: exploitation is over the network, low complexity, requires an authenticated low-privileged account (PR:L), needs no user interaction, and yields only limited integrity and availability impact with no confidentiality loss. No EPSS score is provided in the input, there is no CISA KEV listing, and no public exploit is identified - so the exploitation-probability and active-exploitation signals are either absent or negative. The vulnerable code path and fix are fully documented (vendor issue #2668, patch PR #2673, and the exact CashRegistersService.php lines), which makes the flaw easy to understand and reproduce but does not amount to weaponized exploit code. The vuln.today decision label is 'this_month', not act_now or emergency, aligning with a genuine-but-not-urgent authorization bug rather than a widespread or actively exploited threat. Net: this is a real, patch-worthy insider/multi-tenant integrity issue for NexoPOS operators, not a high-CVSS-but-illusory finding - but its blast radius is limited to users who already hold a valid cashier account, which is why severity stays medium.

A store with multiple cashiers gives each the default nexopos.use.registers permission. A malicious or compromised cashier, authenticated to the POS API, sends a crafted POST to /api/cash-registers/{action}/{register} targeting a register session opened by a different cashier, force-closing that session or injecting cash-in/cash-out entries to distort its balance. No public exploit code is identified, but the advisory and patch document the exact endpoint, making reproduction straightforward for any authenticated cashier.