CVE-2026-105039

EnergizeLab station-middleware NestJS Docker images 1.6.5 through 1.8.2 do not check user roles on administrative APIs. Any authenticated low-privilege user can retrieve AI provider keys and change configuration and object-store contents...

CVE-2026-105037

EnergizeLab station-middleware NestJS Docker images 1.6.5 through 1.8.2 allow any registered, low-privilege account to read arbitrary files from the server by supplying an attacker-controlled file path. This exposes middleware files and server secrets...

CVE-2026-105039 EnergizeLab Station Middleware Admin APIs Missing Role Checks

EnergizeLab station-middleware NestJS Docker images 1.6.5 through 1.8.2 do not check user roles on administrative APIs. Any authenticated low-privilege user can retrieve AI provider keys and change configuration and object-store contents...

CVE-2026-105039

EnergizeLab station-middleware (NestJS) Docker images versions 1.6.5 through 1.8.2 are vulnerable to a Missing Authorization (CWE-862) flaw. The application fails to perform role checks on administrative APIs, allowing any authenticated low-privilege user to perform unauthorized actions. Attacker...

EUVD-2026-102435

EnergizeLab station-middleware NestJS Docker images 1.6.5 through 1.8.2 do not check user roles on administrative APIs. Any authenticated low-privilege user can retrieve AI provider keys and change configuration and object-store contents...

CVE-2026-105039 EnergizeLab Station Middleware Admin APIs Missing Role Checks

EnergizeLab station-middleware NestJS Docker images 1.6.5 through 1.8.2 do not check user roles on administrative APIs. Any authenticated low-privilege user can retrieve AI provider keys and change configuration and object-store contents...

CVE-2026-105037 EnergizeLab Station Middleware Authenticated Path Traversal Arbitrary File Read

EnergizeLab station-middleware NestJS Docker images 1.6.5 through 1.8.2 allow any registered, low-privilege account to read arbitrary files from the server by supplying an attacker-controlled file path. This exposes middleware files and server secrets...

CVE-2026-105037 EnergizeLab Station Middleware Authenticated Path Traversal Arbitrary File Read

EnergizeLab station-middleware NestJS Docker images 1.6.5 through 1.8.2 allow any registered, low-privilege account to read arbitrary files from the server by supplying an attacker-controlled file path. This exposes middleware files and server secrets...

CVE-2026-105037

EnergizeLab station-middleware (NestJS) Docker images, specifically versions 1.6.5 through 1.8.2 , are vulnerable to an authenticated path traversal vulnerability. A registered, low-privilege account can read arbitrary files from the server by providing an attacker-controlled file path. This flaw...

EUVD-2026-102433

EnergizeLab station-middleware NestJS Docker images 1.6.5 through 1.8.2 allow any registered, low-privilege account to read arbitrary files from the server by supplying an attacker-controlled file path. This exposes middleware files and server secrets...

PT-2026-115224

Name of the Vulnerable Software and Affected Versions EnergizeLab station-middleware NestJS Docker images versions 1.6.5 through 1.8.2 Description Low-privilege registered accounts can read arbitrary files from the server by providing a controlled file path. This issue allows unauthorized access ...

PT-2026-115226

Name of the Vulnerable Software and Affected Versions EnergizeLab station-middleware NestJS Docker images versions 1.6.5 through 1.8.2 Description Insufficient authorization checks on administrative APIs allow authenticated users with low privileges to perform unauthorized actions. This includes...

CVE-2026-105039: Missing Authorization

EnergizeLab station-middleware NestJS Docker images 1.6.5 through 1.8.2 do not check user roles on administrative APIs. Any authenticated low-privilege user can retrieve AI provider keys and change configuration and object-store contents...

CVE-2026-105037: External Control of File Name or Path

EnergizeLab station-middleware NestJS Docker images 1.6.5 through 1.8.2 allow any registered, low-privilege account to read arbitrary files from the server by supplying an attacker-controlled file path. This exposes middleware files and server secrets...

EnergizeLab station-middleware authorization issue vulnerability

The EnergizeLab station-middleware versions 1.6.5 to 1.8.2 have authorization-related vulnerabilities. This issue arises from the management API not checking user roles, which may allow any authenticated, low-privilege user to obtain AI provider keys and alter configuration settings as well as...

EnergizeLab station-middleware: Input validation error vulnerability

The EnergizeLab station-middleware versions 1.6.5 to 1.8.2 have a vulnerability related to input validation errors. This vulnerability stems from external control over file paths, allowing any registered low-privilege account to access any file on the server by using a file path controlled by the...