CVE record · 1 source
CVE-2026-105039
CVSS 9.6EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 do not check user roles on administrative APIs.
- Vendor
- Node.js
- Product
- Node.js
- CVSS
- 9.6
- EPSS
- 0.003 (p22)
- Exposure class
- Developer platform
Coverage
1Every item in the archive that references this CVE, highest rank first. Headlines open the publisher.
-
EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 do not check user roles on administrative APIs.
EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 do not check user roles on administrative APIs. Any authenticated low-privilege user can retrieve AI provider keys and change configuration and…