{"id":"CVE-2026-105039","published":"2026-10-15T21:17:04.587","lastModified":"2026-10-16T20:17:18.590","description":"EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 do not check user roles on administrative APIs. Any authenticated low-privilege user can retrieve AI provider keys and change configuration and object-store contents.","cvssScore":9.6,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","cwes":["CWE-862"],"vendors":[],"products":[],"references":[{"url":"https://github.com/xn0tsa/your-secrets-are-safe-with-me","tags":[]},{"url":"https://takeonme.org/gcves/GCVE-1337-2026-00000000000000111111111111111111111000000000000000000011111100111111111111000000000000000000011111111111111101010000000000000010011/","tags":[]},{"url":"https://www.theverge.com/tech/1010727/eiliko-robot-hack-energize-lab","tags":[]}],"exploitRefs":[{"url":"https://github.com/xn0tsa/your-secrets-are-safe-with-me","tags":[]}],"hasPoc":true,"ai":{"summary":"A role-checking flaw in EnergizeLab's station-middleware Docker images allows low-privilege authenticated users to access administrative APIs and retrieve sensitive AI provider keys. This creates a critical privilege escalation vulnerability where any user can modify configuration and object-store contents.","exploitability":"Exploitation is straightforward requiring only an authenticated user account with minimal prerequisites, as the application fails to validate user roles before allowing access to administrative endpoints.","blast_radius":"The impact could be severe across multiple systems as attackers could access AI provider keys, modify configurations, and alter object-store contents, potentially compromising entire AI workflows and data integrity.","remediation":"Upgrade to station-middleware Docker images version 1.8.3 or later to address the role validation flaw in administrative APIs.","detection":"Monitor for unauthorized access attempts to administrative endpoints by low-privilege users in application logs, specifically looking for API calls to configuration and object-store modification endpoints that would normally require elevated privileges.","tags":["auth-bypass","privilege-escalation","api","config"],"model":"garnet-coder","analyzedAt":"2026-10-16T08:47:51.035Z"}}