Vulnerabilidades do EnergizeLab Station-middleware
🔔 Criar alerta RSS Verificador de versão
CVEs publicadas que afetam EnergizeLab Station-middleware: 2 registro(s), com versões afetadas e correções.
CVE-2026-105039
Crítica · 9.6
CWE-862 15/10/2026
EnergizeLab Station Middleware Admin APIs Missing Role Checks
EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 do not check user roles on administrative APIs. Any authenticated low-privilege user can retrieve AI provider keys and change configuration and object-store contents.
CVE-2026-105037
Crítica · 9.9
CWE-73 15/10/2026
EnergizeLab Station Middleware Authenticated Path Traversal Arbitrary File Read
EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 allow any registered, low-privilege account to read arbitrary files from the server by supplying an attacker-controlled file path. This exposes middleware files and server secrets.