Vulnerability-Lookup

CVE-2026-71537 (GCVE-0-2026-71537)

Vulnerability from cvelistv5 – Published: 2026-09-18 17:43 – Updated: 2026-09-18 17:43

Title

Paymenter: Credit-refund double-spend race condition in service downgrade (doUpgrade)

Summary

Paymenter is a free and open-source webshop solution for management of hosting services. Prior to 1.5.7, app/Livewire/Services/Upgrade.php::doUpgrade() relies on Service::upgradable to check for a pending service upgrade and later executes $credit->increment('amount', abs($price)) without DB::transaction or lockForUpdate() spanning those operations. An authenticated customer with an active downgradable service can submit concurrent downgrade requests that each observe no pending upgrade, create separate upgrade records, and increment the same account credit balance, producing multiple spendable refunds for one downgrade. This issue is fixed in version 1.5.7.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

CWE

CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/Paymenter/Paymenter/security/a…	x_refsource_CONFIRM
https://github.com/Paymenter/Paymenter/commit/a42…	x_refsource_MISC
https://github.com/Paymenter/Paymenter/releases/t…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
Paymenter	Paymenter	Affected: < 1.5.7	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Paymenter",
          "vendor": "Paymenter",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.5.7"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Paymenter is a free and open-source webshop solution for management of hosting services. Prior to 1.5.7, app/Livewire/Services/Upgrade.php::doUpgrade() relies on Service::upgradable to check for a pending service upgrade and later executes $credit-\u003eincrement(\u0027amount\u0027, abs($price)) without DB::transaction or lockForUpdate() spanning those operations. An authenticated customer with an active downgradable service can submit concurrent downgrade requests that each observe no pending upgrade, create separate upgrade records, and increment the same account credit balance, producing multiple spendable refunds for one downgrade. This issue is fixed in version 1.5.7."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-362",
              "description": "CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-18T17:43:02.740Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/Paymenter/Paymenter/security/advisories/GHSA-5gmm-hjfj-8ff7",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Paymenter/Paymenter/security/advisories/GHSA-5gmm-hjfj-8ff7"
        },
        {
          "name": "https://github.com/Paymenter/Paymenter/commit/a42e7f8bafce054ad70de3a2c2ac94d13579f41b",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Paymenter/Paymenter/commit/a42e7f8bafce054ad70de3a2c2ac94d13579f41b"
        },
        {
          "name": "https://github.com/Paymenter/Paymenter/releases/tag/v1.5.7",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Paymenter/Paymenter/releases/tag/v1.5.7"
        }
      ],
      "source": {
        "advisory": "GHSA-5gmm-hjfj-8ff7",
        "discovery": "UNKNOWN"
      },
      "title": "Paymenter: Credit-refund double-spend race condition in service downgrade (doUpgrade)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-71537",
    "datePublished": "2026-09-18T17:43:02.740Z",
    "dateReserved": "2026-08-06T21:24:15.375Z",
    "dateUpdated": "2026-09-18T17:43:02.740Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-71537",
      "date": "2026-09-20",
      "epss": "0.00232",
      "percentile": "0.14356"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "Paymenter",
                "vendor": "Paymenter",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 1.5.7"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Paymenter is a free and open-source webshop solution for management of hosting services. Prior to 1.5.7, app/Livewire/Services/Upgrade.php::doUpgrade() relies on Service::upgradable to check for a pending service upgrade and later executes $credit-\u003eincrement(\u0027amount\u0027, abs($price)) without DB::transaction or lockForUpdate() spanning those operations. An authenticated customer with an active downgradable service can submit concurrent downgrade requests that each observe no pending upgrade, create separate upgrade records, and increment the same account credit balance, producing multiple spendable refunds for one downgrade. This issue is fixed in version 1.5.7."
          }
        ],
        "id": "CVE-2026-71537",
        "lastModified": "2026-09-18T18:17:12.153",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 6.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 3.6,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-18T18:17:11.937",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/Paymenter/Paymenter/commit/a42e7f8bafce054ad70de3a2c2ac94d13579f41b"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/Paymenter/Paymenter/releases/tag/v1.5.7"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/Paymenter/Paymenter/security/advisories/GHSA-5gmm-hjfj-8ff7"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-362"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Primary"
          }
        ]
      }
    }
  }
}

GHSA-5GMM-HJFJ-8FF7

Vulnerability from github – Published: 2026-09-18 17:58 – Updated: 2026-09-18 17:58

Summary

Paymenter has a credit-refund double-spend race condition in service downgrade (doUpgrade)

Details

Summary

The service downgrade implementation in app/Livewire/Services/Upgrade.php::doUpgrade() executes a proration calculation and a subsequent user credit refund without any transactional safety or database locks. The only concurrency check relies on an unisolated database query checking for existing pending upgrades. Because there is no active database transaction or pessimistic row-level lock spanning this validation and the subsequent credit update, concurrent downgrade requests can bypass the guard simultaneously. This allows a user to trigger multiple refunds for a single service downgrade.

Technical Details

The issue occurs because the application verifies eligibility using an unlocked read operation (Service::upgradable) which checks if a pending upgrade row exists. Since there is no enclosing DB::transaction or lockForUpdate(), multiple requests sent in parallel can all query the database at the same millisecond, observe that no pending upgrade exists, and pass the safety check.

Once passed, each concurrent request inserts its own pending upgrade record and executes $credit->increment('amount', abs($price)). Because the balance updates are not serialized against the initial check, the user's credit balance is cumulatively inflated by $N$ times the refund amount for a single legitimate downgrade.

Impact

This race condition allows any authenticated customer with an active, downgradable service to inflate their spendable credit balance to an arbitrary multiple of their legitimate refund amount.

Because the newly granted balance acts as real, spendable store credit, it can be immediately leveraged to settle future platform invoices or provision additional services, resulting in direct financial and resource loss to the operator.

Severity

6.5 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 1.5.6"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "paymenter/paymenter"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.5.7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-71537"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-362"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-18T17:58:55Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Summary\n\nThe service downgrade implementation in `app/Livewire/Services/Upgrade.php::doUpgrade()` executes a proration calculation and a subsequent user credit refund without any transactional safety or database locks. The only concurrency check relies on an unisolated database query checking for existing pending upgrades. Because there is no active database transaction or pessimistic row-level lock spanning this validation and the subsequent credit update, concurrent downgrade requests can bypass the guard simultaneously. This allows a user to trigger multiple refunds for a single service downgrade.\n\n### Technical Details\n\nThe issue occurs because the application verifies eligibility using an unlocked read operation (`Service::upgradable`) which checks if a pending upgrade row exists. Since there is no enclosing `DB::transaction` or `lockForUpdate()`, multiple requests sent in parallel can all query the database at the same millisecond, observe that no pending upgrade exists, and pass the safety check.\n\nOnce passed, each concurrent request inserts its own pending upgrade record and executes `$credit-\u003eincrement(\u0027amount\u0027, abs($price))`. Because the balance updates are not serialized against the initial check, the user\u0027s credit balance is cumulatively inflated by $N$ times the refund amount for a single legitimate downgrade.\n\n### Impact\n\nThis race condition allows any authenticated customer with an active, downgradable service to inflate their spendable credit balance to an arbitrary multiple of their legitimate refund amount.\n\nBecause the newly granted balance acts as real, spendable store credit, it can be immediately leveraged to settle future platform invoices or provision additional services, resulting in direct financial and resource loss to the operator.",
  "id": "GHSA-5gmm-hjfj-8ff7",
  "modified": "2026-09-18T17:58:55Z",
  "published": "2026-09-18T17:58:55Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/Paymenter/Paymenter/security/advisories/GHSA-5gmm-hjfj-8ff7"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Paymenter/Paymenter/commit/a42e7f8bafce054ad70de3a2c2ac94d13579f41b"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/Paymenter/Paymenter"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Paymenter/Paymenter/releases/tag/v1.5.7"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Paymenter has a credit-refund double-spend race condition in service downgrade (doUpgrade)"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-71537 (GCVE-0-2026-71537)

GHSA-5GMM-HJFJ-8FF7

Summary

Technical Details

Impact

Tags

Sightings

Nomenclature

Related by attack behaviour