The vulnerability identified as CVE-2026-39609 affects Wava Payment versions up to 0.3.7 and is due to missing authorization checks. This results in incorrectly configured access control security levels, allowing unauthorized users to perform actions that should require proper authorization. The CVSS 3.1 base score is 5.3, reflecting a network attack vector with low complexity, no privileges required, and no user interaction needed. The impact is limited to integrity, with no confidentiality or availability impact reported. No vendor advisory or patch information is currently available, and the product is not a cloud service.

The vulnerability allows unauthorized users to bypass access controls and perform unauthorized actions that can alter data integrity within the Wava Payment system. There is no impact on confidentiality or availability. Exploitation does not require privileges or user interaction, increasing the risk of unauthorized modifications. However, no known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should review and strengthen access control configurations where possible to limit exposure. Monitor for vendor updates regarding patches or official mitigations.