CVE-2026-71537 Details
Description
Paymenter is a free and open-source webshop solution for management of hosting services. Prior to 1.5.7, app/Livewire/Services/Upgrade.php::doUpgrade() relies on Service::upgradable to check for a pending service upgrade and later executes $credit->increment('amount', abs($price)) without DB::transaction or lockForUpdate() spanning those operations. An authenticated customer with an active downgradable service can submit concurrent downgrade requests that each observe no pending upgrade, create separate upgrade records, and increment the same account credit balance, producing multiple spendable refunds for one downgrade. This issue is fixed in version 1.5.7.
A race condition vulnerability has been identified in Paymenter, a webshop solution for hosting service management, in versions prior to 1.5.7. The issue arises in the service downgrade process, where the application fails to properly manage concurrent requests. The vulnerability allows authenticated customers with downgradable services to exploit the system by submitting multiple downgrade requests at the same time. Each request bypasses the pending upgrade check, leading to the creation of multiple upgrade records and an inflated credit balance. This excess credit can be used for refunds or to pay for additional services, causing financial loss to the service operator.
Users can update to Paymenter version 1.5.7 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 18, 2026CISA-ADP
Assessed Sep 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Paymenter/Paymenter/commit/a42e7f8bafce054ad70de3a2c2ac94d13579f41b | [email protected] | Source CodeVendor |
| https://github.com/Paymenter/Paymenter/releases/tag/v1.5.7 | [email protected] | Release NotesVendor |
| https://github.com/Paymenter/Paymenter/security/advisories/GHSA-5gmm-hjfj-8ff7 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-362 | Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Paymenter | <= 1.5.6 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 24, 2026 | CVE Modified | CISA-ADP |
| Sep 18, 2026 | New CVE Received | [email protected] |