Vulnerability · Published Oct 16, 2026 · Assigned by VulnCheck

CVE-2026-111637NexoPOS through 6.2.4 Unauthenticated Transaction Disclosure via /api/fields Endpoint

Medium 5.3

In plain English

A medium-severity missing authentication in NexoPOS from Blair2004. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.5%top 59.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

NexoPOS through 6.2.4 contains a missing authentication vulnerability that allows unauthenticated attackers to read accounting transaction records via GET /api/fields/{resource}/{identifier}. Attackers can request transaction field classes like ns.entity-transaction with sequential ids to retrieve names, values, account ids, and descriptions without nexopos.read.transactions permission.

Affected products (as reported)

Vendor	Product	Versions
Blair2004	NexoPOS	0 – through 6.2.4

Weakness: CWE-306 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References

https://hackmd.io/@hieuPenguinnn/nexopos-fields-endpoint-unauthenticated-transaction-disclosure third-party-advisory
https://github.com/Blair2004/NexoPOS/blob/v6.2.4/routes/api-base.php#L10-L18 technical-description
https://github.com/Blair2004/NexoPOS/blob/v6.2.4/app/Providers/FormsProvider.php#L126-L152 technical-description
VulnCheck Advisory: NexoPOS through 6.2.4 Unauthenticated Transaction Disclosure via /api/fields Endpoint third-party-advisory