A critical access control vulnerability in the platform ApiPayController component allows unauthenticated remote attackers to exfiltrate sensitive data.

The vulnerability is an incorrect access control flaw within the ApiPayController.java component, which lacks proper authorization checks, allowing unauthenticated remote attackers to gain unauthorized access to sensitive information.

The exploitation of this flaw enables unauthorized access to sensitive data, which may lead to significant privacy breaches, regulatory non-compliance, and loss of intellectual property. With a CVSS score of 7.5, the vulnerability is classified as High, reflecting the ease of remote exploitation without requiring authentication or user interaction.

Immediate Action: Contact the software provider to obtain a security update or patch for the platform software, as no official fix version is currently documented.

Proactive Monitoring: Review web server and application logs for anomalous requests directed at the ApiPayController endpoint, specifically looking for unexpected GET or POST patterns from unknown sources.

Compensating Controls: Implement strict network segmentation and apply WAF rules to block access to the affected controller endpoint from untrusted networks until a permanent patch is applied.

Public Exploit Available: Yes — a published proof-of-concept exists as referenced in the provided GitHub Gist.

Given the high CVSS severity and the presence of a public proof-of-concept, this vulnerability presents a significant risk to data confidentiality. Administrators must prioritize identifying instances of the affected platform within their environment and restrict network access to the vulnerable component until a vendor-supplied patch is successfully deployed.