{"id":"CVE-2026-105039","aliases":["EUVD-2026-102435","GHSA-mhf9-fr35-f2j3"],"status":"published","title":"EnergizeLab Station Middleware Admin APIs Missing Role Checks","description":"EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 do not check user roles on administrative APIs. Any authenticated low-privilege user can retrieve AI provider keys and change configuration and object-store contents.","severity":{"version":"3.1","score":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00293,"percentile":0.22125,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-862"],"published":"2026-10-15T20:43:38Z","modified":"2026-10-16T20:17:18Z","products":[{"vendor":"energizelab","product":"station-middleware"}],"references":[{"url":"https://github.com/xn0tsa/your-secrets-are-safe-with-me","tags":["technical-description"]},{"url":"https://takeonme.org/gcves/GCVE-1337-2026-00000000000000111111111111111111111000000000000000000011111100111111111111000000000000000000011111111111111101010000000000000010011/","tags":["third-party-advisory"]},{"url":"https://www.theverge.com/tech/1010727/eiliko-robot-hack-energize-lab","tags":["media-coverage"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105039"},{"url":"https://takeonme.org/gcves/GCVE-1337-2026-00000000000000111111111111111111111000000000000000000011111100111111111111000000000000000000011111111111111101010000000000000010011"},{"url":"https://github.com/advisories/GHSA-mhf9-fr35-f2j3"}],"sources":{"cve":[{"id":"CVE-2026-105039","title":"EnergizeLab Station Middleware Admin APIs Missing Role Checks","description":"EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 do not check user roles on administrative APIs. Any authenticated low-privilege user can retrieve AI provider keys and change configuration and object-store contents.","status":"published","published":"2026-10-15T20:43:38.761Z","modified":"2026-10-16T19:55:16.658Z","cvss":[{"version":"3.1","score":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","level":"critical","assessor":"cna"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:19:56.755658Z"}],"euvd":[{"id":"EUVD-2026-102435","description":"EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 do not check user roles on administrative APIs. Any authenticated low-privilege user can retrieve AI provider keys and change configuration and object-store contents.","status":"published","published":"2026-10-15T20:43:38Z","modified":"2026-10-16T19:55:16Z","cvss":[{"version":"3.1","score":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T17:00:01.858348Z"}],"ghsa":[{"id":"GHSA-mhf9-fr35-f2j3","title":"EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 do not check user roles...","description":"EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 do not check user roles on administrative APIs. Any authenticated low-privilege user can retrieve AI provider keys and change configuration and object-store contents.","status":"published","published":"2026-10-15T21:36:14Z","modified":"2026-10-15T21:36:22Z","cvss":[{"version":"3.1","score":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T15:13:49.895192Z"}],"nvd":[{"id":"CVE-2026-105039","description":"EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 do not check user roles on administrative APIs. Any authenticated low-privilege user can retrieve AI provider keys and change configuration and object-store contents.","status":"published","published":"2026-10-15T21:17:04.587Z","modified":"2026-10-16T20:17:18.59Z","cvss":[{"version":"3.1","score":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","level":"critical","assessor":"secondary"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:12:59.751798Z"}]}}