The vulnerability in EnergizeLab station-middleware (NestJS), affecting Docker images 1.6.5 through 1.8.2, allows any authenticated user that does not have administrative privileges to access administrative APIs. These APIs are responsible for retrieving AI provider keys and for modifying system configuration and object‑store contents. The missing role checks enable unauthorized read and write access to sensitive data and configuration parameters, representing a classic missing access control weakness (CWE‑862).

EnergizeLab station-middleware (Docker images) versions 1.6.5 through 1.8.2 are impacted. The product is deployed via Docker containers that expose administrative endpoints to users authenticated against the middleware API.

The CVSS score of 9.6 indicates a high severity, and while the EPSS score is not available, the vulnerability is not listed in CISA KEV, suggesting that an exploit is not yet widespread. The likely attack vector is any authenticated low‑privilege user who can send requests to the exposed administrative APIs. Because the role checks are missing, such an attacker can disclose AI provider credentials, alter system configuration, and modify object‑store contents, potentially leading to data exfiltration, system compromise, or service disruption.