Description
Paymenter is a free and open-source webshop solution for management of hosting services. Prior to 1.5.7, app/Livewire/Services/Upgrade.php::doUpgrade() relies on Service::upgradable to check for a pending service upgrade and later executes $credit->increment('amount', abs($price)) without DB::transaction or lockForUpdate() spanning those operations. An authenticated customer with an active downgradable service can submit concurrent downgrade requests that each observe no pending upgrade, create separate upgrade records, and increment the same account credit balance, producing multiple spendable refunds for one downgrade. This issue is fixed in version 1.5.7.
Published: 2026-09-18
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized multiple refunds leading to financial loss
Action: Immediate Patch
AI Analysis

Impact

This race condition in the upgrade service allows an authenticated customer to submit overlapping downgrade requests, each creating a new upgrade record and incrementing the same account credit. Because these operations are not wrapped in a database transaction or locked, the same refund can be spent multiple times, effectively double‑spending the customer’s credit. The flaw is a classic concurrent execution issue and is identified as CWE‑362.

Affected Systems

The issue appears in all releases of Paymenter before version 1.5.7, including 1.5.6 and earlier. The affected component is the Livewire service upgrade logic located in app/Livewire/Services/Upgrade.php::doUpgrade().

Risk and Exploitability

The CVSS score of 6.5 indicates a moderate severity, but the financial impact of generating multiple refunds can be substantial. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting it has not yet been widely exploited in the wild. Attackers need an authenticated account with a service that can be downgraded and the ability to orchestrate concurrent requests; no additional privileges are required beyond normal user rights.

Generated by OpenCVE AI on September 19, 2026 at 11:46 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Paymenter to version 1.5.7 or later to apply the official fix that protects credit increments with proper transaction handling.
  • If an upgrade is not immediately possible, add application‑level serialization for downgrade requests on a per‑service basis or employ database row locks to block simultaneous operations before processing the credit adjustment.
  • Monitor account credit activity for anomalous spikes or repetitive increments that could indicate exploitation of the race condition until a definitive fix is deployed.

Generated by OpenCVE AI on September 19, 2026 at 11:46 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-5gmm-hjfj-8ff7 Paymenter has a credit-refund double-spend race condition in service downgrade (doUpgrade)
History

Fri, 18 Sep 2026 21:30:00 +0000

Type Values Removed Values Added
Description Paymenter is a free and open-source webshop solution for management of hosting services. Prior to 1.5.7, app/Livewire/Services/Upgrade.php::doUpgrade() relies on Service::upgradable to check for a pending service upgrade and later executes $credit->increment('amount', abs($price)) without DB::transaction or lockForUpdate() spanning those operations. An authenticated customer with an active downgradable service can submit concurrent downgrade requests that each observe no pending upgrade, create separate upgrade records, and increment the same account credit balance, producing multiple spendable refunds for one downgrade. This issue is fixed in version 1.5.7.
Title Paymenter: Credit-refund double-spend race condition in service downgrade (doUpgrade)
Weaknesses CWE-362
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-09-18T17:43:02.740Z

Reserved: 2026-08-06T21:24:15.375Z

Link: CVE-2026-71537

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-09-18T18:17:11.937

Modified: 2026-09-18T18:17:12.153

Link: CVE-2026-71537

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-19T12:00:08Z

Weaknesses
  • CWE-362

    Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')