Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.6
CVE-2026-105039: EnergizeLab station-middleware allows any user to change settings
CVE-2026-105039 · published 2 days ago
Summary
The EnergizeLab station-middleware Docker images (versions 1.6.5 to 1.8.2) do not verify a user's role when accessing administrative functions. As a result, a signed‑in user with minimal rights can view AI provider keys, modify configuration, and alter stored objects. Update to a version that adds proper role checks or apply the vendor's patch as soon as possible.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| energizelab | station-middleware | <= 1.8.2 |
Original advisory text
EnergizeLab Station Middleware Admin APIs Missing Role Checks
EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 do not check user roles on administrative APIs. Any authenticated low-privilege user can retrieve AI provider keys and change configuration and object-store contents.
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Type
CWE-862Missing Authorization
Timeline
Published15 Oct 2026
Updated17 Oct 2026
First seen15 Oct 2026
Track software like this
Free during beta