Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-55219— Paymenter: Race condition in payWithCredit() enables credit double-spend

Quick assessment

Affected
Paymenter Paymenter
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Paymenter是Paymenter公司开源的一个网店托管软件。 Paymenter 1.5.5之前版本存在竞争条件问题漏洞，该漏洞源于credit payment实现在app/Livewire/Invoices/Show.php中在活动数据库事务外执行悲观行锁，导致竞态条件问题，并发付款请求可同时读取相同的信用余额，允许用户使用相同的信用余额支付多个发票，从而造成平台直接的经济或资源损失。

CVSS 5.3 · Medium EPSS 0.21% · P11

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

VendorProduct Version RangeStatus
Paymenter Paymenter < 1.5.5 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-55219

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Paymenter: Race condition in payWithCredit() enables credit double-spend
Source: CVE Program / CVE List V5
Vulnerability Description
Paymenter is a free and open-source webshop solution for management of hosting services. In versions prior to 1.5.5, the credit payment implementation in app/Livewire/Invoices/Show.php executes a pessimistic row lock (lockForUpdate()) outside of an active database transaction. Because MySQL/MariaDB requires an enclosing transaction to enforce row-level locks, the guard is ineffective. Concurrent payment requests can exploit this race condition to read the same credit balance simultaneously, allowing users to pay multiple invoices using the same credit balance. In database systems like MySQL, a row lock only works inside a formal transaction; without one, the lock is completely ignored. Because there is no active lock, two payment requests sent at the exact same millisecond can look at the database at the same time. Both requests see the original credit balance, decide it is sufficient, and approve the payment. Because the payment processes successfully through ExtensionHelper::addPayment(), the application provisions the corresponding services or digital goods, resulting in direct financial or resource loss to the platform. This issue has been fixed in version 1.5.5.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
使用共享资源的并发执行不恰当同步问题(竞争条件)
Source: CVE Program / CVE List V5
Vulnerability Title
Paymenter 竞争条件问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Paymenter是Paymenter公司开源的一个网店托管软件。 Paymenter 1.5.5之前版本存在竞争条件问题漏洞，该漏洞源于credit payment实现在app/Livewire/Invoices/Show.php中在活动数据库事务外执行悲观行锁，导致竞态条件问题，并发付款请求可同时读取相同的信用余额，允许用户使用相同的信用余额支付多个发票，从而造成平台直接的经济或资源损失。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Paymenter Paymenter < 1.5.5 -

II. Public POCs for CVE-2026-55219

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-55219

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-55219 (1)

Same Patch Batch · Paymenter · 2026-07-20 · 5 CVEs total

CVE-2026-47198 8.5 HIGH Paymenter: URL parameter injection bypasses paid plan limits at checkout
CVE-2026-44585 5.4 MEDIUM Paymenter: Broken object level authorization via service reference manipulation on ticket
CVE-2026-44583 5.3 MEDIUM Paymenter: Blind Unauthenticated SSRF on the Paypal gateway module
CVE-2026-44584 4.3 MEDIUM Paymenter doesn't reset email verification status after email change

IV. Related Vulnerabilities

Same product: Paymenter
Same vendor: Paymenter
Same weakness: CWE-362

V. Comments for CVE-2026-55219

No comments yet

Leave a comment