CVE-2026-55219

Received Received - Intake

Race Condition in Paymenter Webshop Credit System

Publication date: 2026-07-20

Last updated on: 2026-07-20

Assigner: GitHub, Inc.

Description

Paymenter is a free and open-source webshop solution for management of hosting services. In versions prior to 1.5.5, the credit payment implementation in app/Livewire/Invoices/Show.php executes a pessimistic row lock (lockForUpdate()) outside of an active database transaction. Because MySQL/MariaDB requires an enclosing transaction to enforce row-level locks, the guard is ineffective. Concurrent payment requests can exploit this race condition to read the same credit balance simultaneously, allowing users to pay multiple invoices using the same credit balance. In database systems like MySQL, a row lock only works inside a formal transaction; without one, the lock is completely ignored. Because there is no active lock, two payment requests sent at the exact same millisecond can look at the database at the same time. Both requests see the original credit balance, decide it is sufficient, and approve the payment. Because the payment processes successfully through ExtensionHelper::addPayment(), the application provisions the corresponding services or digital goods, resulting in direct financial or resource loss to the platform. This issue has been fixed in version 1.5.5.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-20

Last Modified

2026-07-20

Generated

2026-07-21

AI Q&A

2026-07-21

EPSS Evaluated

N/A

NVD

CVE-2026-55219

Affected Vendors & Products

Vendor	Product	Version / Range
paymenter	paymenter	to 1.5.5 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-362	The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

Attack-Flow Graph

Executive Summary

This is a race condition vulnerability in Paymenter versions before 1.5.5. The credit payment system uses a row lock to prevent duplicate payments but fails because the lock is applied outside a database transaction. MySQL/MariaDB requires transactions to enforce row locks, making the lock ineffective. Concurrent payment requests can read the same credit balance simultaneously, allowing users to pay multiple invoices with the same credits.

Detection Guidance

This vulnerability is specific to the Paymenter application and involves a race condition in credit payment processing. Detection requires checking for concurrent payment requests exploiting the same credit balance without proper transaction locking. Review application logs for duplicate payments or simultaneous invoice processing with the same credit source. No direct system/network commands are provided in the context.

Impact Analysis

This vulnerability allows attackers to exploit a race condition to pay for multiple invoices using the same credit balance. This results in financial loss for the platform as services or digital goods are provisioned without sufficient funds. Platforms using Paymenter versions prior to 1.5.5 are at risk of direct resource or monetary loss.

Compliance Impact

This vulnerability could lead to financial loss and unauthorized resource provisioning, which may violate compliance requirements under GDPR (data protection) and HIPAA (financial and health data security) if paymenter handles such data. The lack of proper transaction handling and race condition risks may result in unauthorized transactions, potentially breaching regulatory controls.

Mitigation Strategies

Upgrade Paymenter to version 1.5.5 or later to address the race condition in credit payment processing.

Hi! I’m here to help you understand CVE-2026-55219. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70