Threats affecting pkg:github/blair2004/NexoPOS

NexoPOS versions up to 6.3.0 have an authorization bypass vulnerability that allows authenticated cashiers with the default permission nexopos.use.registers to manipulate other cashiers' register sessions. This occurs because the CashRegistersService does not verify that the user performing actions on a register session is the session owner. Attackers can submit POST requests to the cash register API endpoints to force-close sessions or alter cash balances without proper authorization.

NexoPOS through 6.2.4 contains a missing authentication vulnerability that allows unauthenticated attackers to read accounting transaction records via GET /api/fields/{resource}/{identifier}. Attackers can request transaction field classes like ns.entity-transaction with sequential ids to retrieve names, values, account ids, and descriptions without nexopos.read.transactions permission.