CVE-2026-111637
MEDIUM 6.9NexoPOS through 6.2.4 contains a missing authentication vulnerability that allows unauthenticated attackers to read accounting transaction records via GET /api/fields/{resource}/{identifier}. Attackers can request transaction field classes like ns.entity-transaction with sequential ids to retrieve names, values, account ids, and descriptions without nexopos.read.transactions permission.
No known exploitation, public exploit, or elevated probability at this time. Track for changes.
Exploitation likelihood
0.5%chance of exploitation in 30 days · 40th percentile
Impact if exploited
6.9CVSS 4.0 · MEDIUM
- ConfidentialityLow
- IntegrityNone
- AvailabilityNone
What an attacker needs
- ✓Access: Reachable over the network — no local access needed
- ✓Privileges: No account or privileges required
- ✓User interaction: No user interaction needed
- ✓Complexity: No special conditions — reliably repeatable
- ✓Requirements: No special attack requirements
✓ lowers the bar for an attacker · ⚠ raises it
Proof of concept
No public PoC is currently catalogued.
Search for new PoCs
Search GitHub now — results may be empty or unverified.
Tracked sources are checked daily for recent CVEs, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.
Data snapshot:
Weakness (CWE)
- CWE-306: Missing Authentication for Critical Function
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
References and research data (JSON)
All CVSS metrics
- MEDIUM 6.9 v4.0 · CNA Primary
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N - MEDIUM 5.3 v3.1 · CNA Primary
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - MEDIUM 6.9 v4.0 · NVD Secondary
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - MEDIUM 5.3 v3.1 · NVD Secondary
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
References
Exploit-tagged references (not proof of a PoC)
- https://hackmd.io/@hieuPenguinnn/nexopos-fields-endpoint-unauthenticated-transaction-disclosure CVE record · VulnCheck · Updated 2026-10-16T17:39:08.931Z
CVE record · CISA-ADP · Updated 2026-10-16T19:12:40.180Z
NVD · CVE-2026-111637 · Updated 2026-10-16T20:17:21.290
Advisories
- https://www.vulncheck.com/advisories/nexopos-through-6.2.4-unauthenticated-transaction-disclosure-via-api-fields-endpoint CVE record · VulnCheck · Updated 2026-10-16T17:39:08.931Z
NVD · CVE-2026-111637 · Updated 2026-10-16T20:17:21.290 - https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-103059 EUVD · EUVD-2026-103059
Technical & other
- https://github.com/Blair2004/NexoPOS/blob/v6.2.4/routes/api-base.php#L10-L18 CVE record · VulnCheck · Updated 2026-10-16T17:39:08.931Z
NVD · CVE-2026-111637 · Updated 2026-10-16T20:17:21.290 - https://github.com/Blair2004/NexoPOS/blob/v6.2.4/app/Providers/FormsProvider.php#L126-L152 CVE record · VulnCheck · Updated 2026-10-16T17:39:08.931Z
NVD · CVE-2026-111637 · Updated 2026-10-16T20:17:21.290