What is the CVSS score of CVE-2026-1989?

CVE-2026-1989 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.4%.

Which versions of Pavo Pay are affected by CVE-2026-1989?

PAVO Pay installations through build 09/07/2026 are vulnerable to unauthenticated access of other customers' financial data via identifier manipulation, creating immediate breach and regulatory…

How to fix or mitigate CVE-2026-1989?

Within 24 hours: Conduct urgent inventory of all PAVO Pay deployments; engage legal, compliance, and breach response teams; assess which customer financial records are accessible. Within 7 days: Implement network segmentation restricting PAVO Pay to trusted internal systems, deploy WAF rules blocking sequential identifier patterns, enable comprehensive access logging with alerting, and establish rate limiting on all PAVO Pay API endpoints. Within 30 days: Execute remediation-evaluate replacement payment platforms with active vendor security commitment, or pursue urgent custom access-control hardening if PAVO Pay architecture permits application-layer mitigations.

Pavo Pay CVE-2026-1989

EUVD-2026-42553 HIGH

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-07-09 TR-CERT

GHSA-wq8w-54vc-9f9q

Authentication Bypass Pavo Pay

7.5

CVSS 3.1 · Vendor: TR-CERT

Severity by source

Vendor (TR-CERT) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from Vendor (TR-CERT) · only source for this CVE.

CVSS VectorVendor: TR-CERT

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 09, 2026 - 10:04 vuln.today

DescriptionCVE.org

Authorization bypass through User-Controlled key vulnerability in PAVO Financial Technology Solutions Inc. PAVO Pay allows Exploitation of Trusted Identifiers.

This issue affects PAVO Pay: through 09072026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Broken object-level authorization in PAVO Pay (all builds through 09072026) lets remote attackers access other users' resources by substituting user-controlled identifiers (CWE-639, IDOR-class), exposing sensitive financial data with no integrity or availability impact. Reported by Turkey's national CSIRT (TR-CERT) and tracked in the ENISA EUVD, the flaw scores CVSS 7.5 driven entirely by high confidentiality impact over an unauthenticated network path. No public exploit is identified at time of analysis, but the vendor did not respond to coordinated disclosure and no fix has been released, leaving all deployments exposed.