# CVE-2025-52026: Aptsys gemscms information disclosure in getCashiers endpoint

Source: https://junglewise.ai/threats/cve-2025-52026-aptsys-gemscms-information-disclosure-in-getcashiers-endpoint  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-01-23. Updated: 2026-07-05  
License: CC BY 4.0 with a link back

CVE-2025-52026 · Severity: high · CVSS 7.5 · Published 2026-01-23

Aptsys gemscms, a backend platform used for Point of Sale (POS) operations, contains a security flaw that exposes sensitive staff information. An unprotected web interface allows anyone on the internet to download a list of cashier accounts, including their names, email addresses, and passwords. Because the passwords are stored using an obsolete and weak security method, attackers can easily convert them back into plain text to gain unauthorized access to the POS system and business operations.

Technologies: [Aptsys Gemscms Backend](https://junglewise.ai/threats/technologies/gemscms-backend). Vendors: [Aptsys](https://junglewise.ai/threats/vendors/aptsys).

## Quick answers

**Is CVE-2025-52026 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-52026 being exploited in the wild.

**How severe is CVE-2025-52026?** High severity, with a CVSS score of 7.5, published 23 January 2026.

**Which products and versions are affected?** Aptsys GemsCMS thru 2025-05-28.

**Is there a fix for CVE-2025-52026?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2025-52026 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2025-52026?** Check whether you run Aptsys GemsCMS or Aptsys Gemscms Backend at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An information disclosure vulnerability exists in the Aptsys gemscms backend platform due to an unauthenticated API endpoint at /srvs/membersrv/getCashiers. A remote, unauthenticated attacker can access this endpoint to retrieve a list of cashier account details, including usernames, email addresses, and password hashes. The passwords are hashed using the MD5 algorithm (CWE-327), which is cryptographically broken and susceptible to rapid collision or preimage attacks using public tools. Successful exploitation allows an attacker to recover plaintext credentials and perform unauthorized logins to sensitive POS or backend functions. As of the latest advisory, the vendor has not acknowledged the issue and no patch is available.

## Affected products

- Aptsys gemscms backend thru 2025-05-28

## Timeline

- 2025-05-28: disclosed: Vulnerability discovered and initial vendor notification attempted.
- 2026-01-23: advisory: CVE published to NVD.

## References

- [https://gist.github.com/ReverseThatApp/4a6be2b9b2ba39d38c35c8753e0afd39](https://gist.github.com/ReverseThatApp/4a6be2b9b2ba39d38c35c8753e0afd39)

## Related threats

- [Aptsys gemscms SQL injection in GetServiceByRestaurantID](https://junglewise.ai/threats/cve-2025-52025-aptsys-gemscms-sql-injection-in-getservicebyrestaurantid)
- [Aptsys gemscms POS Platform authentication bypass in Web Services module](https://junglewise.ai/threats/cve-2025-52024-aptsys-gemscms-pos-platform-authentication-bypass-in-web-services)
- [Aptsys GemsCMS information disclosure via verbose error messages](https://junglewise.ai/threats/cve-2025-52023-aptsys-gemscms-information-disclosure-via-verbose-error-messages)
- [Aptsys gemscms and gemsloyalty information disclosure via verbose error messages](https://junglewise.ai/threats/cve-2025-52022-aptsys-gemscms-and-gemsloyalty-information-disclosure-via-verbose)