The answer you got on the VASP forum here (thank you for giving us that in your question!) said to look in spinsym.F but was not clear at all, especially due to the typo in the formatting of that file name.
I just looked in the file vasp.5.4.4_2D/src/spinsym.F and did a case-insensitive search for "Pauli" and found this:
! Define Pauli-matrices
sig=zero
sig(1,2,1)=cmplx( 1.0_q, 0.0_q,kind=q)
sig(2,1,1)=cmplx( 1.0_q, 0.0_q,kind=q)
sig(1,2,2)=cmplx( 0.0_q,-1.0_q,kind=q)
sig(2,1,2)=cmplx( 0.0_q, 1.0_q,kind=q)
sig(1,1,3)=cmplx( 1.0_q, 0.0_q,kind=q)
sig(2,2,3)=cmplx(-1.0_q, 0.0_q,kind=q)
I did the same for "Cartan" and found nothing (which did not surprise me at all.
Therefore I can conclude the following: All Pauli matrices are given exactly as in the introduction of this article, and they are labeled as follows:
sig(:,:,1) is $\sigma_x$
sig(:,:,2) is $\sigma_y$
sig(:,:,3) is $\sigma_z$
I have never run a VASP calculation in my life, nor ever looked at any of its code, but I'm not at all surprised that they chose to define the SU(2) operators in this way!