CVE-2026-117606
Deferred Deferred - Pending Action

Authenticated Cash Register Session Manipulation in NexoPOS

Publication date: 2026-10-28

Last updated on: 2026-10-28

Assigner: VulnCheck

Description
NexoPOS through 6.3.0 contains a missing authorization vulnerability that allows authenticated cashiers to manipulate other cashiers' register sessions because CashRegistersService never compares used_by with the user. Attackers holding the default nexopos.use.registers permission can submit closing, cash-in, or cash-out actions to POST /api/cash-registers/{action}/{register} to force-close sessions or alter balances.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-28
Last Modified
2026-10-28
Generated
2026-10-28
AI Q&A
2026-10-28
EPSS Evaluated
N/A
NVD
CVE-2026-117606
EUVD
EUVD-2026-111541

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Blair2004 NexoPOS 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in NexoPOS (versions up to 6.3.0) allows authenticated cashiers with the default 'nexopos.use.registers' permission to perform actions like closing registers, cashing in, or cashing out on behalf of other cashiers without proper ownership checks. The CashRegistersService fails to verify if the user initiating the action matches the user assigned to the session, enabling unauthorized manipulation of register sessions and balances.

Detection Guidance

To detect this vulnerability, monitor API logs for POST requests to /api/cash-registers/{action}/{register} with actions like register-cash-out, register-cash-in, or register-closing. Check if responses return 200 OK for actions performed by users not associated with the session. Verify if CashRegistersService lacks user ownership checks in the codebase.

Impact Analysis

An attacker could forcefully close another cashier's register session, alter register balances by cashing in or out without authorization, or terminate sessions improperly. This could lead to financial discrepancies, unauthorized accounting changes, and disruption of normal business operations. Physical cash removal or identity concealment is not confirmed, but accounting records may still log the acting user's ID.

Mitigation Strategies

Apply the fix from pull request #2673 which adds session ownership checks in CashRegistersService. Ensure only the authenticated user associated with a session can perform actions. Temporarily revoke the nexopos.use.registers permission from cashiers until the fix is applied. Monitor for unauthorized actions in logs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-117606. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart