The vulnerability in NexoPOS versions up to 6.2.4 allows an unauthenticated attacker to read accounting transaction data through the /api/fields/{resource}/{identifier} endpoint. By sending GET requests to this endpoint with sequential identifiers, an attacker can retrieve transaction names, values, account identifiers, and descriptions without requiring the nexopos.read.transactions permission, resulting in the disclosure of sensitive financial information. The weakness is a missing authentication check (CWE‑306) that permits any external user to access protected data.

Blair2004’s NexoPOS product, versions 6.2.4 and earlier, is affected. The vulnerability impacts all installations that expose the /api/fields endpoint without enforcing authentication.

The CVSS base score of 6.9 indicates moderate severity, and the exploit is straightforward because the API endpoint does not require authentication. Attackers need only send simple GET requests to the endpoint, which can be performed from anywhere with network access to the server; no credentials or special permissions are required. The EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, but the lack of authentication makes exploitation highly likely for exposed endpoints.