CVE-2026-44584

Paymenter is a free and open-source webshop solution for management of hosting services. In versions prior to 1.5.0, the email update functionality fails to invalidate the existing verification state when a user changes their email address, allowing a verified account to retain its verified status after switching to an unverified or unowned email address. When a user updated their email address, the system did not reset or revalidate the associated email verification status. As a result, the verification column remained set to “true” even after the email address was changed. Exploitation could potentially result in: misrepresentation of email ownership, bypass of verification-based trust assumptions, and abuse of features gated behind verified status. No direct unauthorized access to other users accounts or data is possible through this issue alone. This issue has been fixed in version 1.5.0.

• CWE-345

• https://github.com/Paymenter/Paymenter/security/advisories/GHSA-rv89-wch8-c574

Published

Jul 20, 2026

Last Modified

Jul 23, 2026

Status

Deferred

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-44579Next.js is a React framework for building full-stack web app…7.5
• CVE-2026-4458Use after free in Extensions in Google Chrome prior to 146.0…8.8
• CVE-2026-44580Next.js is a React framework for building full-stack web app…6.1
• CVE-2026-44581Next.js is a React framework for building full-stack web app…4.7
• CVE-2026-44582Next.js is a React framework for building full-stack web app…3.7
• CVE-2026-44583Paymenter is a free and open-source webshop solution for man…5.3
• CVE-2026-44585Paymenter is a free and open-source webshop solution for man…5.4
• CVE-2026-44586SiYuan is an open-source personal knowledge management syste…8.3
• CVE-2026-44587CarrierWave is a framework to upload files from Ruby applica…6.1
• CVE-2026-44588SiYuan is an open-source personal knowledge management syste…9.4
• CVE-2026-44589Nuxt OG Image generates OG Images with Vue templates in Nuxt…3.7
• CVE-2026-4459Out of bounds read and write in WebAudio in Google Chrome pr…8.8