CVE-2026-82211

{
  "etk_id": "ETK-2026-853",
  "cve_id": "CVE-2026-82211",
  "display_id": "CVE-2026-82211",
  "ghsa_id": "GHSA-65w5-qcwh-f3g3",
  "euvd_id": "EUVD-2026-94195",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Unauthenticated payment-result validation flaw in Nexi XPay Build",
  "summary": "Nexi XPay Build versions through 7.6.2 inadequately validate payment outcomes submitted to certain public routes. An unauthenticated attacker able to reach those routes may alter or cancel orders and obtain order keys that can reveal guest buyer details.",
  "mitigation": "Disable the plugin or restrict unauthenticated access to its payment-result routes until a vendor update is available. Monitor affected orders for unexpected status changes and cancellations.",
  "vendor": null,
  "product": "Nexi XPay Build",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 7.0.0, <= 7.6.2"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "Nexi XPay Build",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": 8.2,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N",
  "epss_score": 0.0019,
  "epss_percentile": 0.0783,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": true,
  "check_confidence_basis": "assessed",
  "exploit": false,
  "pipeline_minutes": 37.19437955,
  "t0_at": "2026-10-07T06:47:53.228000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-07T08:15:20.281584+00:00",
      "days": 0.060729786851851854,
      "is_lower_bound": false,
      "measured_at": "2026-10-07T06:47:53.228000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-07T06:47:53.228000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-07T06:47:53.228000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-82211"
    }
  }
}