Improper Authorization in PayRange API Reveals Network Device Details
CVE-2026-18965

8.7HIGH

Key Information:

Vendor

Payrange

Status
Payrange Api
Vendor
CVE Published:
27 August 2026

What is CVE-2026-18965?

The PayRange API has a significant vulnerability where it lacks adequate authorization controls on management endpoints. This flaw allows unauthorized access to detailed information about every device connected to the PayRange network, potentially exposing sensitive data to attackers. Organizations utilizing this API should promptly review their security measures and implement necessary controls to prevent unauthorized access and data breaches.

Affected Version(s)

PayRange API All versions

References

https://www.cisa.gov/news-events/ics-advisories/icsa-26-2...
government-resource
https://github.com/cisagov/CSAF/blob/develop/csaf_files/O...

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Tahi Wilton Geary reported this vulnerability to CISA.
.