DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-71537: CVE-2026-71537: Credit-Refund Double-Spend Race Condition in Paymenter Service Downgrade

#security #cve #cybersecurity

CVE-2026-71537: Credit-Refund Double-Spend Race Condition in Paymenter Service Downgrade

Vulnerability ID: CVE-2026-71537
CVSS Score: 6.5
Published: 2026-09-18

A concurrent execution vulnerability (CWE-362) exists in the Paymenter webshop solution within the service downgrade execution path (doUpgrade). Authenticated customers can exploit this concurrency issue by sending concurrent HTTP requests to trigger multiple parallel executions of the refund process. Because the application checks for pending upgrades without database transactional isolation or exclusive row locks, attackers can generate multiple duplicate refunds to their account balance for a single downgrade action. This leads to arbitrary credit inflation on the platform.

TL;DR

A race condition in Paymenter allows authenticated users to trigger multiple credit refunds for a single service downgrade by making synchronized, concurrent requests to the Livewire downgrade component. This occurs due to lack of row locking during state validation.

Technical Details

  • CWE ID: CWE-362
  • Attack Vector: Network (AV:N)
  • CVSS v3.1 Score: 6.5
  • Impact: High Integrity (Unauthorized Credit Manipulation)
  • Exploit Status: None / Theoretical (No public PoC)
  • CISA KEV Status: Not Listed

Affected Systems

  • Paymenter hosting management webshop installations prior to version 1.5.7
  • Paymenter: < 1.5.7 (Fixed in: 1.5.7)

Code Analysis

Commit: a42e7f8

Fix double refund race condition in doUpgrade using database transactions and pessimistic locking.

DB::beginTransaction(); ... lockForUpdate() ... DB::commit();
Enter fullscreen mode Exit fullscreen mode

Mitigation Strategies

  • Upgrade to Paymenter version 1.5.7 or higher immediately.
  • Disable the 'credits_on_downgrade' setting in the administration dashboard if immediate patching is not possible.
  • Configure strict rate limiting on the Livewire upgrade component endpoint via a WAF or reverse proxy.

Remediation Steps:

  1. Log in to the host hosting the Paymenter application.
  2. Pull the latest code or update the container image to target version 1.5.7.
  3. Run 'php artisan migrate' to ensure any database updates are properly synchronized.
  4. Verify that 'credits_on_downgrade' behavior functions securely by executing a test downgrade in a staging environment.

References

Read the full report for CVE-2026-71537 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)