Vulnerability in Paymenter
CVE-2026-71537
Paymenter is a free and open-source webshop solution for management of hosting services. Prior to 1.5.7, app/Livewire/Services/Upgrade.php::doUpgrade() relies on Service::upgradable to check for a pending service upgrade and later executes $credit->increment('amount', abs($price)) without DB::transaction or lockForUpdate() spanning those operations. An authenticated customer with an active downgradable service can submit concurrent downgrade requests that each observe no pending upgrade, create separate upgrade records, and increment the same account credit balance, producing multiple spendable refunds for one downgrade. This issue is fixed in version 1.5.7.
Vulnerability class: Race Condition
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N.
Affected products
- Paymenter — versions < 1.5.7
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM)
- security-advisories@github.com (x_refsource_MISC)
- security-advisories@github.com (x_refsource_MISC)
Frequently asked questions
- What is CVE-2026-71537?
- CVE-2026-71537 is a medium-severity vulnerability in Paymenter, classified under Concurrent Execution using Shared Resource with Improper Synchronization (Race Condition). CVSS score: 6.5/10. Published 2026-09-18.
- How severe is CVE-2026-71537?
- Medium severity. CVSS v3 base score is 6.5 out of 10.