CVE-2026-117606 Details
Description
NexoPOS through 6.3.0 contains a missing authorization vulnerability that allows authenticated cashiers to manipulate other cashiers' register sessions because CashRegistersService never compares used_by with the user. Attackers holding the default nexopos.use.registers permission can submit closing, cash-in, or cash-out actions to POST /api/cash-registers/{action}/{register} to force-close sessions or alter balances.
A missing authorization vulnerability has been identified in NexoPOS versions through 6.3.0. This vulnerability allows authenticated cashiers to interfere with other cashiers' register sessions. The issue arises because the CashRegistersService does not verify if the 'used_by' field matches the current user. Cashiers with the 'nexopos.use.registers' permission can exploit this by sending closing, cash-in, or cash-out requests to the API, effectively forcing the closure of sessions or manipulation of cash balances.
The vulnerability has been addressed in NexoPOS version 6.3.0. Users should update to this version.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 28, 2026CISA-ADP
Assessed Nov 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| NexoPOS | <= 6.3.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 4, 2026 | CVE Modified | CISA-ADP |
| Oct 28, 2026 | New CVE Received | [email protected] |