CVE-2026-117606: NexoPOS through 6.3.0 Missing Authorization via Cash Register Session Actions

Q: Who is exposed to this issue?

Authenticated users who hold the nexopos.use.registers permission, including cashiers with that default permission, can target cash-register sessions used by other cashiers.

Q: What does an attacker need to exploit it?

The attacker needs an authenticated NexoPOS account with the nexopos.use.registers permission and the ability to send requests to the cash-register action endpoint. No user interaction is required.

Q: What actions can be performed against another cashier's session?

An attacker can submit closing, cash-in, or cash-out actions to POST /api/cash-registers/{action}/{register}. This can force-close another cashier's session or alter register balances.

Q: How can administrators determine whether their deployment is affected?

NexoPOS versions through 6.3.0 are affected. Review whether cashier accounts have nexopos.use.registers and whether they can invoke closing, cash-in, or cash-out actions against registers associated with other users.

Published Oct 28, 2026

Updated

NexoPOS through 6.3.0 contains a missing authorization vulnerability that allows authenticated cashiers to manipulate other cashiers' register sessions because CashRegistersService never compares usedby with the user. Attackers holding the default nexopos.use.registers permission can submit closing, cash-in, or cash-out actions to POST /api/cash-registers/{action}/{register} to force-close sessions or alter balances.

Affected Software

1 affected component

NexoPOS NexoPOS<=6.3.0

Event History

Oct 28, 2026

CVE Published

via MITRE·02:03 AM

Data Sourced

via MITRE·02:03 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

Authenticated users who hold the nexopos.use.registers permission, including cashiers with that default permission, can target cash-register sessions used by other cashiers.

What does an attacker need to exploit it?

The attacker needs an authenticated NexoPOS account with the nexopos.use.registers permission and the ability to send requests to the cash-register action endpoint. No user interaction is required.

What actions can be performed against another cashier's session?

An attacker can submit closing, cash-in, or cash-out actions to POST /api/cash-registers/{action}/{register}. This can force-close another cashier's session or alter register balances.

How can administrators determine whether their deployment is affected?

NexoPOS versions through 6.3.0 are affected. Review whether cashier accounts have nexopos.use.registers and whether they can invoke closing, cash-in, or cash-out actions against registers associated with other users.

CVE-2026-117606: NexoPOS through 6.3.0 Missing Authorization via Cash Register Session Actions

Affected Software

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What actions can be performed against another cashier's session?

How can administrators determine whether their deployment is affected?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What actions can be performed against another cashier's session?

How can administrators determine whether their deployment is affected?