CVE-2026-105039: EnergizeLab Station Middleware Admin APIs Missing Role Checks
Published Oct 15, 2026
·Updated
EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 do not check user roles on administrative APIs. Any authenticated low-privilege user can retrieve AI provider keys and change configuration and object-store contents.
Affected Software
1 affected component
EnergizeLab station-middleware>=1.6.5<=1.8.2
Event History
Oct 15, 2026
CVE Published
via MITRE·08:43 PM
Data Sourced
via MITRE·08:43 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which deployments are affected?
EnergizeLab station-middleware Docker images from version 1.6.5 through 1.8.2 are affected.
2
What access does an attacker need?
An attacker needs an authenticated low-privilege account. No user interaction is required.
3
What could a successful attacker do?
A low-privilege authenticated user can access administrative APIs to retrieve AI provider keys and modify configuration and object-store contents.