PT-2026-115226

CVE-2026-105039

Published

2026-10-15

Updated

2026-10-15

Description by

CVSS 3.1

9.6

Critical

MetricsAV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions EnergizeLab station-middleware (NestJS) Docker images versions 1.6.5 through 1.8.2

Description Insufficient authorization checks on administrative APIs allow authenticated users with low privileges to perform unauthorized actions. This includes the ability to retrieve AI provider keys and modify system configurations and object-store contents.

Recommendations Update EnergizeLab station-middleware (NestJS) Docker images to a version newer than 1.8.2.

Exploitability

Fix

Impacts

Researchers

Sammy Azdoufal

Todb

Vendors

Affected products

Weakness enumeration

CWE-862: Missing Authorization

Related identifiers