# CVE-2025-52024: Aptsys gemscms POS Platform authentication bypass in Web Services module

Source: https://junglewise.ai/threats/cve-2025-52024-aptsys-gemscms-pos-platform-authentication-bypass-in-web-services  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-01-23. Updated: 2026-07-05  
License: CC BY 4.0 with a link back

CVE-2025-52024 · Severity: critical · CVSS 9.4 · Published 2026-01-23

Aptsys POS Platform, a system used for managing point-of-sale transactions and restaurant operations, contains a security flaw that exposes internal developer tools to the public internet. An unauthorized person can access these tools to view and execute sensitive commands, such as adjusting customer credits, retrieving transaction history, and performing internal data queries. This could lead to financial fraud, theft of customer data, and significant disruption to business operations.

Technologies: [Aptsys Gemscms Backend](https://junglewise.ai/threats/technologies/gemscms-backend). Vendors: [Aptsys](https://junglewise.ai/threats/vendors/aptsys).

## Quick answers

**Is CVE-2025-52024 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-52024 being exploited in the wild.

**How severe is CVE-2025-52024?** Critical severity, with a CVSS score of 9.4, published 23 January 2026.

**Which products and versions are affected?** Aptsys gemscms POS Platform Web Services through 2025-05-28.

**Is there a fix for CVE-2025-52024?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2025-52024 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2025-52024?** Check whether you run Aptsys gemscms POS Platform Web Services or Aptsys Gemscms Backend at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A security misconfiguration in the Aptsys gemscms POS Platform Web Services module allows unauthenticated access to internal developer testing panels. These panels, accessible via predictable URL paths in production environments, provide a directory-style index of backend services and HTML forms for submitting test input. A remote attacker can use these interfaces to discover and execute sensitive API endpoints without any session validation or authentication. Impacted functions include user transaction retrieval, credit adjustments, POS actions, and internal database queries. As of the advisory date, the vendor has not acknowledged the issue, and it remains unpatched.

## Affected products

- Aptsys gemscms POS Platform Web Services through 2025-05-28

## Timeline

- 2025-04-01: other: Vulnerability discovered
- 2025-05-01: other: Vendor notified repeatedly through November 2025
- 2025-07-01: other: CVE reserved
- 2025-11-18: disclosed: Public disclosure via GitHub Gist
- 2026-01-23: advisory: NVD advisory published

## References

- [https://gist.github.com/ReverseThatApp/4a6be2b9b2ba39d38c35c8753e0afd39](https://gist.github.com/ReverseThatApp/4a6be2b9b2ba39d38c35c8753e0afd39)

## Related threats

- [Aptsys gemscms information disclosure in getCashiers endpoint](https://junglewise.ai/threats/cve-2025-52026-aptsys-gemscms-information-disclosure-in-getcashiers-endpoint)
- [Aptsys gemscms SQL injection in GetServiceByRestaurantID](https://junglewise.ai/threats/cve-2025-52025-aptsys-gemscms-sql-injection-in-getservicebyrestaurantid)
- [Aptsys GemsCMS information disclosure via verbose error messages](https://junglewise.ai/threats/cve-2025-52023-aptsys-gemscms-information-disclosure-via-verbose-error-messages)
- [Aptsys gemscms and gemsloyalty information disclosure via verbose error messages](https://junglewise.ai/threats/cve-2025-52022-aptsys-gemscms-and-gemsloyalty-information-disclosure-via-verbose)