CVE-2026-111637 Details

A missing authentication vulnerability has been identified in NexoPOS versions through 6.2.4. This vulnerability allows unauthenticated attackers to access accounting transaction records via the API endpoint GET /api/fields/{resource}/{identifier}. Attackers can exploit this by requesting specific transaction field classes, such as ns.entity-transaction, using sequential identifiers. This method retrieves sensitive information including transaction names, values, account IDs, and descriptions, all without the necessary permissions. The vulnerability arises because the fields route is not protected by authentication or authorization checks, leaving confidential data exposed to anonymous users.

To address this vulnerability, move the fields route inclusion inside the authenticated API group and add a permission check for the ns.entity-transaction resource. This can be done by modifying the routes/api-base.php file to include the fields route within the auth:sanctum group and by adding a permission guard to the fields route in routes/api/fields.php.