This vulnerability (CVE-2026-1989) in PAVO Pay is classified under CWE-639, which involves authorization bypass through user-controlled keys. An attacker can exploit trusted identifiers by manipulating keys under their control to bypass authorization mechanisms. The issue affects PAVO Pay versions up to 2026-07-09. No vendor response or patch has been provided as of the publication date. The CVSS 3.1 vector indicates the vulnerability is remotely exploitable without privileges or user interaction, with high confidentiality impact but no integrity or availability impact.

Successful exploitation allows an attacker to bypass authorization controls, potentially gaining unauthorized access to sensitive information or functionality within PAVO Pay. The confidentiality impact is high, meaning sensitive data could be exposed. There is no reported impact on integrity or availability. No known exploits are currently in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or provided a fix, users should monitor for official updates. Until a patch is available, restrict exposure of PAVO Pay services to trusted networks and consider additional access controls to mitigate risk.