CVE-2026-105039
station-middleware: EnergizeLab Station Middleware Admin APIs Missing Role Checks
EnergizeLab station-middleware
CVSS
9.6CriticalExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.29%Chance of exploitation activity in the next 30 days, higher than 20% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
What fixes it
No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.
Description
EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 do not check user roles on administrative APIs. Any authenticated low-privilege user can retrieve AI provider keys and change configuration and object-store contents.
Text from CVE List
Affected versions 1
- station-middlewareaffected: 1.6.5 through 1.8.2CVE List
References 3
- takeonme.org/gcves/GCVE-1337-2026-00000000000000111111111111111111111000000000000000000011111100111111111111000000000000000000011111111111111101010000000000000010011/Advisoryvia CVE List
- github.com/xn0tsa/your-secrets-are-safe-with-meReferencevia CVE List
- theverge.com/tech/1010727/eiliko-robot-hack-energize-labReferencevia CVE List