CVE-2026-111637 Blair2004 CVE debrief

Who should care

NexoPOS users and administrators should verify and patch their installations to prevent potential data exposure. Affected operator, platform, vulnerability-management, and security-team impact should be reviewed to ensure proper mitigation. Users should also monitor transaction records for unauthorized access and review compensating controls for exposed systems.

Why it matters

CVE-2026-111637 allows unauthenticated attackers to read accounting transaction records in NexoPOS through 6.2.4. Defenders should verify and patch their installations to prevent potential data exposure.

• Unauthenticated access to transaction records
• Potential data exposure without proper authorization

Technical summary

NexoPOS through 6.2.4 contains a missing authentication vulnerability that allows unauthenticated attackers to read accounting transaction records via GET /api/fields/{resource}/{identifier}. Attackers can request transaction field classes like ns.entity-transaction with sequential ids to retrieve names, values, account ids, and descriptions without nexopos.read.transactions permission. The vulnerability has a CVSS score of 6.9 and is classified as MEDIUM severity. Defenders should verify and patch their installations to prevent potential data exposure.

Defensive priority

Medium priority for NexoPOS users to verify and patch.

Recommended defensive actions

• Verify NexoPOS version and apply patches if available
• Restrict access to /api/fields endpoint
• Monitor transaction records for unauthorized access
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

Official CVE Program and NVD records confirm the vulnerability in NexoPOS through 6.2.4. The CVE Program record provides source-provided CVE metadata, while the NVD detail page offers a source-specific vulnerability assessment. The vulnerability allows unauthenticated attackers to read accounting transaction records, potentially leading to data exposure. Defenders should verify and patch their installations to prevent this exposure.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.