Executive brief
PayRange API is a web-based system used to manage payment and vending devices across multiple commercial locations. Due to missing authorization checks on administrative endpoints, detailed information about all devices on the PayRange network is exposed to the public without requiring authentication, allowing anyone to view sensitive device configuration data.
Technical details
This vulnerability is a broken access control / missing authorization issue (CWE-862) in PayRange API's management endpoints. The API fails to properly enforce authorization checks, making sensitive device information publicly accessible over the network regardless of authentication status. The affected management endpoints expose verbose details about every device on the PayRange network, including configuration and status data. The vulnerability requires network access to the API endpoints but allows both authenticated and unauthenticated attackers to retrieve sensitive information; attackers may also arbitrarily modify devices or trigger denial-of-service conditions through these same unprotected endpoints. PayRange has not responded to CISA mitigation requests as of the advisory publication date.
Affected products
- PayRange PayRange API all
Timeline
- 2026-08-25: disclosed: CISA ICS Advisory ICSA-26-237-04 published
- 2026-08-28: advisory: CVE-2026-18965 published on NVD