station-middleware vulnerabilities

2 known vulnerabilities in station-middleware from EnergizeLab. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.6 Critical severity

  station-middleware: Missing Authorization

  CVE-2026-105039Oct 15, 2026EnergizeLab

  EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 do not check user roles on administrative APIs. Any authenticated low-privilege user can retrieve AI provider keys and change configuration and object-store contents.

• 9.9 Critical severity

  station-middleware: External Control of File Name or Path

  CVE-2026-105037Oct 15, 2026EnergizeLab

  EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 allow any registered, low-privilege account to read arbitrary files from the server by supplying an attacker-controlled file path. This exposes middleware files and server secrets.