CVE-2026-81767: CWE-862 Missing Authorization in yalla ya! Simple Payment

CVE-2026-81767 is an unauthenticated broken access control vulnerability (CWE-862) affecting yalla ya! Simple Payment software versions up to 2.5.2. The flaw allows attackers without any privileges to bypass authorization controls, potentially leading to unauthorized modification or manipulation of data or operations within the application. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact. No patch or official remediation level has been published by the vendor, and no known exploits have been reported.

The vulnerability allows unauthenticated attackers to bypass access controls, leading to unauthorized integrity-impacting actions within the Simple Payment application. This could result in unauthorized modification of payment data or transactions. There is no impact on confidentiality or availability according to the CVSS vector. No active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected application and monitor for suspicious activity related to unauthorized access attempts. Follow vendor communications closely for updates on patches or mitigations.