CVE-2026-71537

Paymenter is a free and open-source webshop solution for management of hosting services. Prior to 1.5.7, app/Livewire/Services/Upgrade.php::doUpgrade() relies on Service::upgradable to check for a pending service upgrade and later executes $credit->increment('amount', abs($price)) without DB::transaction or lockForUpdate() spanning those operations. An authenticated customer with an active downgradable service can submit concurrent downgrade requests that each observe no pending upgrade, create separate upgrade records, and increment the same account credit balance, producing multiple spendable refunds for one downgrade. This issue is fixed in version 1.5.7.

• CWE-362

• https://github.com/Paymenter/Paymenter/commit/a42e7f8bafce054ad70de3a2c2ac94d13579f41b
• https://github.com/Paymenter/Paymenter/releases/tag/v1.5.7
• https://github.com/Paymenter/Paymenter/security/advisories/GHSA-5gmm-hjfj-8ff7

Published

Sep 18, 2026

Last Modified

Sep 24, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-71511Dolibarr before 24.0.0 contains a sensitive data exposure vu…6.5
• CVE-2026-71513NLTK before 3.10.3 contains a remote code execution vulnerab…8.8
• CVE-2026-71514NLTK 3.9.4 through 3.10.2 contains a path traversal vulnerab…3.3
• CVE-2026-71518Typemill before 2.26.0 contains an authorization bypass vuln…7.5
• CVE-2026-7152A vulnerability was identified in Totolink A8000RU 7.1cu.643…9.8
• CVE-2026-7153A security flaw has been discovered in Totolink A8000RU 7.1c…9.8
• CVE-2026-71538@cyclonedx/cyclonedx-npm creates CycloneDX Software Bill of …8.5
• CVE-2026-71539n8n is an open source workflow automation platform. Prior to…8.9
• CVE-2026-7154A weakness has been identified in Totolink A8000RU 7.1cu.643…9.8
• CVE-2026-71540Wazuh is an open-source security platform providing unified …7.5
• CVE-2026-71543OpenBao is an open source identity-based secrets management …7.5
• CVE-2026-7155A security vulnerability has been detected in Totolink A8000…9.8