CVE-2026-71537mediumCWE-362

CVE-2026-71537: medium-severity vulnerability in Paymenter

Paymenter: Credit-refund double-spend race condition in service downgrade (doUpgrade)

Published · Updated

Follow this CVE+ Monitor Paymenter+ Monitor paymenter/paymenter

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.5epss 0.3%
Paymenter is a free and open-source webshop solution for management of hosting services. Prior to 1.5.7, app/Livewire/Services/Upgrade.php::doUpgrade() relies on Service::upgradable to check for a pending service upgrade and later executes $credit->increment('amount', abs($price)) without DB::transaction or lockForUpdate() spanning those operations. An authenticated customer with an active downgradable service can submit concurrent downgrade requests that each observe no pending upgrade, create separate upgrade records, and increment the same account credit balance, producing multiple spendable refunds for one downgrade. This issue is fixed in version 1.5.7.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Affected products
Paymenter · Paymenter
Related CVEs — Paymenter

In the same product, most dangerous first.

CVE-2025-58048CRITICALPaymenter Vulnerable to Remote Code Execution via Public File UploadsEPSS 0.4%CVE-2026-44583MEDIUMPaymenter: Blind Unauthenticated SSRF on the Paypal gateway moduleEPSS 0.4%CVE-2026-47198HIGHPaymenter: URL parameter injection bypasses paid plan limits at checkoutEPSS 0.4%CVE-2026-44585MEDIUMPaymenter: Broken object level authorization via service reference manipulation on ticket creationEPSS 0.3%CVE-2026-55219MEDIUMPaymenter: Race condition in payWithCredit() enables credit double-spendEPSS 0.2%CVE-2026-44584MEDIUMPaymenter doesn't reset email verification status after email changeEPSS 0.2%