CVE-2025-52026 describes an information disclosure vulnerability in the Aptsys gemscms backend platform. The unauthenticated /srvs/membersrv/getCashiers endpoint returns a list of cashier accounts containing names, email addresses, usernames, and MD5-hashed passwords. Since MD5 is cryptographically broken and reversible with public tools, attackers can recover plaintext passwords from the hashes. This enables unauthorized access to cashier accounts and potentially sensitive POS or backend functions. The vulnerability is rated high severity with a CVSS 3.1 score of 7.5 (network attack vector, low attack complexity, no privileges required, no user interaction, confidentiality impact high). No patch or remediation information is provided.

The vulnerability allows remote attackers to retrieve sensitive cashier account information without authentication. The exposure of MD5-hashed passwords enables attackers to reverse the hashes and obtain plaintext credentials. This can lead to unauthorized logins and access to sensitive point-of-sale operations or backend functions, compromising confidentiality. There is no indication of impact on integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected endpoint and consider implementing stronger password hashing algorithms and authentication controls to prevent unauthorized data exposure.