This vulnerability in Ksher payment system arises from missing authorization checks, allowing attackers to bypass access control mechanisms. It affects Ksher versions up to 1.1.2. The issue stems from incorrectly configured access control security levels, which could permit unauthorized users to perform actions that should be restricted. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, low integrity impact, and low availability impact.

The vulnerability could allow unauthorized users to perform limited unauthorized actions within the Ksher payment system, potentially impacting the integrity and availability of the system. There is no indication of confidentiality impact. No known exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, review and strengthen access control configurations in Ksher deployments to prevent unauthorized access. Monitor vendor communications for updates on patches or official mitigations.