CVE-2026-61978

The CVSS 6.5 rating almost certainly understates the real risk here, and you should treat this as a high-priority patch regardless of the score. The reason is straightforward: this is a payment gateway integrated with Piraeus Bank's settlement infrastructure, and broken access control in that context doesn't behave like a typical auth flaw. An unauthenticated attacker with access to a payment gateway isn't just peeking at data — they're positioned to manipulate transaction streams, probe the bank integration layer, or access merchant settlement data. The consequences compound across transaction volume rather than remaining bounded by a single exploit. The specific framing of this as 'broken' rather than 'missing' access control matters practically. It means authentication exists but authorization checks are inconsistently applied — typically across auxiliary endpoints like status checks, reconciliation calls, or test modes that developers protected in the happy path but treated as operational afterthoughts. This is a well-documented pattern in payment gateway ecosystems, and it tends to persist because these 'temporary' operational endpoints accrete over versions rather than get removed. What should you do? First, treat this as a critical-priority patch regardless of the CVSS moderate rating — the scoring model doesn't account for financial infrastructure blast radius. Second, map your deployment estate immediately: payment gateway software often runs across merchant infrastructure with varied update cadences, and the vulnerability window only closes when every downstream instance updates, not when the vendor ships the patch. Third, audit your integration testing scope: if your last PCI-DSS assessment focused on encryption and cardholder data handling, it likely didn't probe operational endpoints for authorization gaps. The compliance surface and the vulnerability surface don't overlap perfectly. Fourth, after patching, verify that deprecated endpoints are fully removed rather than merely disabled — stubbed-out paths have a history of being rediscovered in future refactors.

Reviewed through automated stages and approved by a human before publication.