CVE-2026-71537: fallo de gravedad media en Paymenter
Paymenter: Credit-refund double-spend race condition in service downgrade (doUpgrade)
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 6.5epss 0.3%
Paymenter is a free and open-source webshop solution for management of hosting services. Prior to 1.5.7, app/Livewire/Services/Upgrade.php::doUpgrade() relies on Service::upgradable to check for a pending service upgrade and later executes $credit->increment('amount', abs($price)) without DB::transaction or lockForUpdate() spanning those operations. An authenticated customer with an active downgradable service can submit concurrent downgrade requests that each observe no pending upgrade, create separate upgrade records, and increment the same account credit balance, producing multiple spendable refunds for one downgrade. This issue is fixed in version 1.5.7.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Productos afectados
Paymenter · PaymenterCVEs relacionadas — Paymenter
En el mismo producto, de las más peligrosas a las menos.
CVE-2025-58048CRITICALPaymenter Vulnerable to Remote Code Execution via Public File UploadsEPSS 0.4%CVE-2026-44583MEDIUMPaymenter: Blind Unauthenticated SSRF on the Paypal gateway moduleEPSS 0.4%CVE-2026-47198HIGHPaymenter: URL parameter injection bypasses paid plan limits at checkoutEPSS 0.4%CVE-2026-44585MEDIUMPaymenter: Broken object level authorization via service reference manipulation on ticket creationEPSS 0.3%CVE-2026-55219MEDIUMPaymenter: Race condition in payWithCredit() enables credit double-spendEPSS 0.2%CVE-2026-44584MEDIUMPaymenter doesn't reset email verification status after email changeEPSS 0.2%