Executive brief
Paymenter, an open-source platform for managing hosting services and webshops, contains a flaw in how it handles user email updates. When a user changes their account email, the system fails to reset their 'verified' status, allowing them to appear as a verified user even if they switch to an email address they do not own. This could allow users to bypass trust-based restrictions or misrepresent their identity within the platform.
Technical details
An insufficient verification of data authenticity (CWE-345) exists in Paymenter's email update logic. When a user modifies their email address, the application does not reset the 'verified' boolean column in the database to false. This allows an authenticated user to first verify a legitimate email and then change it to any arbitrary address while maintaining a verified status without a new confirmation challenge. This bypasses verification-gated features and trust assumptions. The issue is resolved in version 1.5.0.
Affected products
- Paymenter Paymenter < 1.5.0
Timeline
- 2026-06-10: advisory: GitHub security advisory published by maintainers
- 2026-07-20: disclosed: CVE published to NVD dataset
- 2026-07-20: patched: Fix released in version 1.5.0