A user‑supplied service identifier is accepted by the ticket creation endpoint without ownership validation, allowing an authenticated user to reference services belonging to other customers. This does not grant direct access to the service content or confidential data; however, the referenced service information becomes visible to support personnel handling the ticket. The flaw represents an object‑level authorization lapse where the system fails to confirm that the service belongs to the authenticated user before ticket creation. An attacker can therefore create support tickets tied to another user's service, potentially causing support staff to interact with or review unrelated customer services. The vulnerability requires authentication and does not allow modification or retrieval of the target service's data through this endpoint.

Paymenter, an open‑source webshop solution, versions prior to 1.5.0 are affected. The vulnerability is present in the ticket creation API of these releases.

The CVSS score of 5.4 categorises the issue as medium severity, and the EPSS score indicates a very low exploitation probability (<1%). The flaw does not appear in the CISA KEV catalog. Explo requires authentication and permits only the creation of support tickets pointing to another user’s service. The risk lies mainly in exposing service identifiers to the support team, which could lead to inadvertent assistance for unrelated accounts. The likelihood of exploitation is limited to users who rely on the ticket system and can modify client‑side requests.