EnergizeLab Station-middleware vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting EnergizeLab Station-middleware: 2 record(s), with affected versions and fixes.
CVE-2026-105039
Critical · 9.6
CWE-862 Oct 15, 2026
EnergizeLab Station Middleware Admin APIs Missing Role Checks
EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 do not check user roles on administrative APIs. Any authenticated low-privilege user can retrieve AI provider keys and change configuration and object-store contents.
CVE-2026-105037
Critical · 9.9
CWE-73 Oct 15, 2026
EnergizeLab Station Middleware Authenticated Path Traversal Arbitrary File Read
EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 allow any registered, low-privilege account to read arbitrary files from the server by supplying an attacker-controlled file path. This exposes middleware files and server secrets.