CVE-2026-47198

Received Received - Intake

Authentication Bypass in Paymenter via Checkout Injection

Publication date: 2026-07-20

Last updated on: 2026-07-20

Assigner: GitHub, Inc.

Description

Paymenter is a free and open-source webshop solution for management of hosting services. In versions prior to 1.5.1, the checkout component improperly filters URL-writable properties, allowing authenticated users to inject arbitrary key-value pairs into server provisioning parameters. Because bundled server extensions prioritize these user-supplied properties over administrator-defined configurations, a regular user can override hosting plans and resource limits at checkout without special privileges. The Checkout Livewire component's $checkoutConfig property exposed via URL query parameters, only validating keys explicitly defined by an extension's configuration method, allowing any undefined injected keys to bypass validation entirely. These unsanitized keys are then stored directly in the database by the cart component and later passed to server extensions during provisioning, enabling user-injected data to override intended administrator settings. Depending on the active extension, this leads to unauthorized overrides of core resource limits (such as CPU, RAM, storage, or package tiers). No administrative privileges are required to exploit this vulnerability. This issue has been fixed in version 1.5.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-20

Last Modified

2026-07-20

Generated

2026-07-21

AI Q&A

2026-07-21

EPSS Evaluated

N/A

NVD

CVE-2026-47198

Affected Vendors & Products

Vendor	Product	Version / Range
paymenter	paymenter	to 1.5.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
CWE-20	The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

Executive Summary

Paymenter versions before 1.5.1 have a flaw in the checkout component where URL parameters can inject arbitrary settings into server provisioning. The $checkoutConfig property accepts unsanitized keys via query parameters, bypassing validation for undefined keys. These injected values override administrator-defined hosting plans and resource limits without requiring special privileges.

Detection Guidance

Check Paymenter version with: grep -r "version" /path/to/paymenter | grep -i "1.5.1". If version is below 1.5.1, the system is vulnerable. Inspect server provisioning parameters in database for unexpected key-value pairs. Monitor checkout logs for unsanitized URL query parameters.

Impact Analysis

An authenticated user could exploit this to increase their allocated resources (CPU, RAM, storage) beyond purchased plans, potentially causing service disruptions or unauthorized resource consumption. The impact depends on the active server extensions but may lead to financial losses or system instability.

Compliance Impact

This vulnerability could lead to unauthorized overrides of resource limits and hosting plans, potentially exposing sensitive user data or violating data protection requirements under GDPR or HIPAA if such overrides affect data handling or storage configurations.

Mitigation Strategies

Upgrade Paymenter to version 1.5.1 or later to address the improper filtering of URL-writable properties in the checkout component.

Hi! I’m here to help you understand CVE-2026-47198. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70