This vulnerability (CVE-2026-1989) in PAVO Pay allows an attacker to bypass authorization controls by manipulating a user-controlled key, exploiting trusted identifiers within the system. The issue is classified under CWE-639 (Authorization Bypass Through User-Controlled Key). It affects all versions of PAVO Pay up to the date 09072026. The vendor has not provided any response or fix, and no official remediation is documented. The CVSS v3.1 base score is 7.5, indicating a high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact but no integrity or availability impact.

Successful exploitation of this vulnerability could allow an attacker to bypass authorization mechanisms and gain unauthorized access to sensitive information within PAVO Pay. The confidentiality of data is at high risk, while integrity and availability are not impacted according to the CVSS vector. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or provided a fix, organizations using PAVO Pay should monitor for updates from the vendor. Until a patch is available, consider implementing compensating controls such as restricting access to the affected system and monitoring for suspicious activity related to authorization keys.