CVE Catalog
CVE-2026-18965
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk0.44%
37th percentile - higher than 37% of all known CVEs
Summary
The PayRange API is missing proper authorization on management endpoints, which allows verbose details of every device on the PayRange network to be publicly accessible, with or without an account.
Risk Assessment
Public disclosure of device details could allow attackers to identify vulnerable devices and conduct targeted attacks. This may compromise privacy and infrastructure security.
Recommendation
Implement proper authorization on management endpoints immediately and restrict public access to this data. Review access logs.
Original NVD description (English source)
PayRange API is missing proper authorization on management endpoints, which allows verbose details of every device on the PayRange network to be publicly accessible, with or without an account.