# CVE-2026-116461: Omega Solution Restro POS business logic error in sale invoice pricing

Source: https://junglewise.ai/threats/cve-2026-116461-a-vulnerability-was-determined-in-omega-solution-restro-pos-up  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-26. Updated: 2026-10-26  
License: CC BY 4.0 with a link back

CVE-2026-116461 · Severity: medium · CVSS 4.3 · Published 2026-10-26

Omega Solution Restro POS is a point-of-sale system for restaurants. An authenticated attacker can manipulate product prices during invoice creation, allowing them to purchase items at artificially low prices. This could result in significant revenue loss and corrupted financial records for the affected restaurant.

Vendors: [Omega Solution](https://junglewise.ai/threats/vendors/omega-solution).

## Quick answers

**Is CVE-2026-116461 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-116461 being exploited in the wild.

**How severe is CVE-2026-116461?** Medium severity, with a CVSS score of 4.3, published 26 October 2026.

**Which products and versions are affected?** Omega Solution Restro POS up to 20261026.

**Is there a fix for CVE-2026-116461?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-116461 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-116461?** Check whether you run Omega Solution Restro POS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A business logic vulnerability in the /sale-invoice/ endpoint accepts client-controlled productUnitSalePrice parameter without validating it against the server-stored product price. An authenticated attacker can intercept and modify the price to an arbitrary value before submission, and the server accepts the manipulated value. The vulnerability requires authentication but can be exploited by any authenticated user with access to invoice creation.

## Affected products

- Omega Solution Restro POS up to 20261026

## Timeline

- 2026-10-26: disclosed: Vulnerability publicly disclosed on GitHub

## References

- [https://github.com/4m3rr0r/PoCVulDb/issues/29](https://github.com/4m3rr0r/PoCVulDb/issues/29)
- [https://vuldb.com/cve/CVE-2026-116461](https://vuldb.com/cve/CVE-2026-116461)