NexoPOS through 6.3.0 Missing Authorization via Cash Register Session Actions
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fix or patch referenced
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
NexoPOS, a point-of-sale web application, is affected through version 6.3.0. An authenticated cashier can change or close another cashier's cash register session and alter its balance, which can lead to inaccurate cash records and financial losses.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
NexoPOS through 6.3.0 contains a missing authorization vulnerability that allows authenticated cashiers to manipulate other cashiers' register sessions because CashRegistersService never compares used_by with the user. Attackers holding the default nexopos.use.registers permission can submit closing, cash-in, or cash-out actions to POST /api/cash-registers/{action}/{register} to force-close sessions or alter balances.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- Blair2004 NexoPOS
through 6.3.0