This vulnerability in Loc Bui payOS (versions <= 1.0.73) allows Cross-Site Request Forgery (CSRF) attacks, where an attacker can trick an authenticated user into submitting unauthorized requests to the application. The CVSS 3.1 vector indicates the attack can be performed remotely over the network with low attack complexity and no privileges required, but user interaction is necessary. The impact includes limited integrity and availability consequences, with no confidentiality impact reported.

Successful exploitation could allow an attacker to perform unauthorized actions on behalf of an authenticated user, potentially causing limited integrity and availability impacts within the payOS application. There is no indication of confidentiality compromise. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing CSRF protections such as anti-CSRF tokens or other application-level mitigations if possible. Monitor vendor communications for updates on patches or official fixes.