This vulnerability (CVE-2026-54810) in Nexi Payments Nexi XPay is classified as CWE-862 (Missing Authorization). It arises from improperly configured access control mechanisms, allowing unauthorized actions that can impact the availability of the system. The CVSS 3.1 vector indicates the vulnerability is remotely exploitable over the network without authentication or user interaction, with a high impact on availability but no confidentiality or integrity impact. The affected product versions include all versions up to 8.3.1. There is no vendor advisory or patch information available at this time, and the product is not a cloud service, so remediation is the responsibility of the user.

The vulnerability can lead to a denial of service or disruption of availability in Nexi XPay systems due to missing authorization controls. It does not impact confidentiality or integrity according to the CVSS vector. Exploitation does not require privileges or user interaction, increasing the risk of remote attacks causing service outages or interruptions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary workaround is currently available, users should monitor Nexi Payments advisories for updates. In the meantime, review and tighten access control configurations where possible to reduce exposure.