Nexopos
Monthly
NexoPOS through 6.3.0 allows an authenticated cashier holding the default nexopos.use.registers permission to act on register sessions opened by a different cashier, because CashRegistersService never compares the register's used_by value with the requesting user. By posting closing, cash-in, or cash-out actions to /api/cash-registers/{action}/{register}, such a user can force-close another cashier's open session or alter its recorded balance, affecting integrity and availability of register data. The flaw requires a valid low-privileged cashier account and a target session owned by someone else; no public exploit code was identified at time of analysis, and the vendor fix (PR #2673) enforces register ownership.
Unauthenticated remote attackers can read accounting transaction records from NexoPOS through 6.2.4 by requesting GET /api/fields/{resource}/{identifier}, because the endpoint does not enforce the nexopos.read.transactions permission. By enumerating sequential identifiers for transaction field classes such as ns.entity-transaction, an attacker can retrieve transaction field names, values, account IDs, and descriptions; the independent assessment rates this as limited read-only information disclosure (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), and no public exploit identified at time of analysis. This is a genuine but moderate-severity exposure rather than a top-tier emergency, with no integrity or availability impact confirmed.
NexoPOS through 6.3.0 allows an authenticated cashier holding the default nexopos.use.registers permission to act on register sessions opened by a different cashier, because CashRegistersService never compares the register's used_by value with the requesting user. By posting closing, cash-in, or cash-out actions to /api/cash-registers/{action}/{register}, such a user can force-close another cashier's open session or alter its recorded balance, affecting integrity and availability of register data. The flaw requires a valid low-privileged cashier account and a target session owned by someone else; no public exploit code was identified at time of analysis, and the vendor fix (PR #2673) enforces register ownership.
Unauthenticated remote attackers can read accounting transaction records from NexoPOS through 6.2.4 by requesting GET /api/fields/{resource}/{identifier}, because the endpoint does not enforce the nexopos.read.transactions permission. By enumerating sequential identifiers for transaction field classes such as ns.entity-transaction, an attacker can retrieve transaction field names, values, account IDs, and descriptions; the independent assessment rates this as limited read-only information disclosure (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), and no public exploit identified at time of analysis. This is a genuine but moderate-severity exposure rather than a top-tier emergency, with no integrity or availability impact confirmed.