The vulnerability is a missing authorization check in the CashRegistersService of NexoPOS. An authenticated cashier who holds the default "nexopos.use.registers" permission can submit actions to endpoints such as /api/cash‑registers/{action}/{register} without the service verifying that the session is actually used by the acting user. As a result, the attacker can force‑close register sessions or arbitrarily modify cash balances for any cashier. The weakness corresponds to CWE‑639, unauthorized read or modification of state due to missing or incorrect authorization checks. The primary impact is on integrity, as an attacker can alter financial records and potentially orchestrate theft or fraud.

The flaw affects installations of NexoPOS version 6.3.0 and all earlier releases. Versions released after the security fix include the missing authorization check and are not susceptible to the issue. Users of the affected versions are at risk if they have cashier accounts that retain the default "nexopos.use.registers" permission.

With a CVSS score of 5.3, the vulnerability is rated medium but not critical. The EPSS score is not available, so the likelihood of exploitation is uncertain. It is not listed in CISA’s KEV catalog, suggesting no widespread exploitation has been observed to date. Exploitation requires the attacker to be authenticated as a cashier and to possess the default register‑usage permission, indicating an insider or compromised credential scenario. Because the exploitation path involves only internal API calls, the attack vector is likely internal and does not require external access.