CVE-2026-105039
9.6CriticalPublished 15 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- High impact on confidentiality, integrity
- Weakness
- CWE-862
Impact
Authenticated low-privilege users can steal AI provider keys, modify system configuration, and alter object-store data. Attackers only need basic network access and any valid low-privilege user account.
Root cause
The NestJS application fails to enforce role-based access control checks on administrative API endpoints.
Affected systems
EnergizeLab station-middleware Docker images 1.6.5 through 1.8.2
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
Fix & remediation
Fixed version is not listed in the advisory—check vendor releases beyond 1.8.2. As an immediate mitigation, block access to administrative API endpoints at the reverse proxy or restrict network access to trusted IPs.
$ docker images | grep station-middlewareAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 do not check user roles on administrative APIs. Any authenticated low-privilege user can retrieve AI provider keys and change configuration and object-store contents.