This vulnerability, identified as CVE-2026-66473 and classified under CWE-862 (Missing Authorization), affects Xendit Payment software versions up to and including 7.1.0. It allows unauthenticated attackers to bypass access control mechanisms, potentially leading to unauthorized modification of data or actions within the system. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact. No vendor advisory or patch information is currently available, and the product is not a cloud service, so remediation responsibility lies with the user.

The vulnerability enables unauthenticated attackers to perform unauthorized actions that compromise the integrity of the system or data within Xendit Payment up to version 7.1.0. There is no impact on confidentiality or availability according to the CVSS vector. This could lead to unauthorized changes or manipulations in the payment system, potentially affecting transaction integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation is currently documented, users should monitor vendor communications for updates. Until a patch is available, restrict access to the affected versions where possible and consider additional access control measures to mitigate unauthorized access risks.