NexoPOS EUVD-2026-103059

No special conditions beyond network reachability - remote unauthenticated exploitation against default configurations of NexoPOS (through 6.2.4), because the GET /api/fields/{resource}/{identifier} route does not enforce the nexopos.read.transactions permission. The attacker must be able to reach the application's HTTP API and must enumerate the resource/identifier path, specifically transaction field classes such as ns.entity-transaction with sequential numeric ids. Limiting factors: the leak is read-only and confined to transaction field metadata (names, values, account ids, descriptions) with no write or code-execution capability, and exposure is bounded to records that exist and are reachable by id enumeration; instances not exposed to the attacker's network (internal-only or behind an authenticating gateway/WAF) are not reachable.

This is a genuine but moderate-severity exposure rather than a top-tier emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms a network-reachable, low-complexity, unauthenticated flaw requiring no user interaction, which maximizes reachability; however, impact is deliberately scoped to VC:L with VI:N/VA:N - confidentiality only, and only low. The vulnerability is an information-disclosure issue (CWE-306 missing authentication) leaking accounting transaction fields, not a code-execution or data-tampering bug, which is why the base score lands at 6.9 (Medium). No EPSS score, KEV listing, or POC flag was provided in the input, so exploitation probability cannot be quantified; there is no public exploit identified at time of analysis and no evidence of active exploitation. The hackmd write-up and VulnCheck advisory provide detailed technical disclosure (endpoint path, specific field class ns.entity-transaction, sequential-id enumeration), which lowers the barrier to building a working exploit even though none is confirmed packaged. Signals are internally consistent - the unauthenticated-network vector matches the described GET endpoint - so there is no CVSS-versus-description conflict to flag here. Priority should be driven by whether an organization actually runs internet-facing NexoPOS; for those that do, this is a straightforward, easily-automatable data leak worth prompt patching, but it is not a widespread-internet-worm class risk.

An unauthenticated attacker who can reach a NexoPOS instance's API sends GET requests to /api/fields/ns.entity-transaction/{id}, iterating {id} through sequential integers. Because the endpoint does not enforce the nexopos.read.transactions permission, each response returns accounting transaction names, values, account ids, and descriptions, letting the attacker harvest the full financial ledger by enumeration. No public exploit is identified at time of analysis, but the low attack complexity and published technical details make scripted enumeration trivial.