Threats tagged 'ghsa-8px7-qjpp-cj5c'

NexoPOS versions through 6.3.0 have a missing authorization vulnerability that allows authenticated cashiers to manipulate other cashiers' register sessions. This occurs because the CashRegistersService does not verify that the user performing actions on a register session matches the session's assigned user. Attackers with the default permission nexopos.use.registers can submit requests to forcibly close sessions or alter cash balances via the API endpoint POST /api/cash-registers/{action}/{register}.