Read the docs
TI-2026-50118 Aliases CVE-2026-71537GHSA-5gmm-hjfj-8ff7

Paymenter: Credit-refund double-spend race condition in service downgrade (doUpgrade)

Priority LOW 29CWE-362Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

Paymenter is a free and open-source webshop solution for management of hosting services. Prior to 1.5.7, app/Livewire/Services/Upgrade.php::doUpgrade() relies on Service::upgradable to check for a pending service upgrade and later executes $credit->increment('amount', abs($price)) without DB::transaction or lockForUpdate() spanning those operations. An authenticated customer with an active downgradable service can submit concurrent downgrade requests that each observe no pending upgrade, create separate upgrade records, and increment the same account credit balance, producing multiple spendable refunds for one downgrade. This issue is fixed in version 1.5.7.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00325 25th percentileScored 2026-11-07
Fix Fixed Paymenter (Paymenter): 1.5.7paymenter/paymenter (Packagist): 1.5.7

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
PaymenterPaymenterbefore 1.5.71.5.7Patch availableCNA
—paymenter/paymenter (Packagist)before 1.5.71.5.7Patch availableGHSA-5gmm-hjfj-8ff7
  • Paymenter VendorPaymenter Affected before 1.5.7 Fixed in 1.5.7 Patch available CNA
  • paymenter/paymenter (Packagist) Vendor— Affected before 1.5.7 Fixed in 1.5.7 Patch available GHSA-5gmm-hjfj-8ff7

Remediation

  • Fix · CNA Paymenter (Paymenter) Fixed in 1.5.7
  • Fix · GHSA-5gmm-hjfj-8ff7 paymenter/paymenter (Packagist) Fixed in 1.5.7 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-71537
  2. 2026-10-03 Alias added: GHSA-5gmm-hjfj-8ff7

References

Other 4

  • TI-2025-35891 Paymenter Vulnerable to Remote Code Execution via Public File Uploads CVSS 3.1CRITICAL 10.0
  • TI-2026-34786 Paymenter: URL parameter injection bypasses paid plan limits at checkout CVSS 3.1HIGH 8.5
  • TI-2026-32495 Paymenter: Blind Unauthenticated SSRF on the Paypal gateway module CVSS 3.1MEDIUM 5.3
  • TI-2026-32497 Paymenter: Broken object level authorization via service reference manipulation on ticket creation CVSS 3.1MEDIUM 5.4
  • TI-2026-39897 Paymenter: Race condition in payWithCredit() enables credit double-spend CVSS 3.1MEDIUM 5.3
  • TI-2026-32496 Paymenter doesn't reset email verification status after email change CVSS 3.1MEDIUM 4.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences