The vulnerability identified as CVE-2025-31876 affects the Payday product by gunnarpayday, where missing authorization controls allow unauthorized users to access functionality or data that should be restricted. The issue stems from incorrectly configured access control security levels in versions up to and including 3.3.18. The CVSS 3.1 vector indicates the vulnerability is remotely exploitable without privileges or user interaction, with a scope change and limited confidentiality impact. No official patch or vendor advisory details are provided, and the product is not a cloud service.

An attacker can exploit this vulnerability remotely without authentication or user interaction to gain unauthorized access to certain parts of the Payday application. The impact is limited to confidentiality loss, with no integrity or availability effects reported. There are no known active exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix information is provided, users should monitor vendor communications for updates. Until a fix is available, restricting network access to the affected Payday application and reviewing access control configurations may reduce exposure.