Executive brief
Paymenter is a billing and service provisioning platform used by hosting providers to manage customer subscriptions and payments. An authentication race condition in the service downgrade logic allows a customer to receive multiple refunds for a single downgrade action, inflating their account credit balance to an arbitrary amount. This credit can then be used to provision additional services or offset legitimate invoices, causing direct financial loss to the platform operator.
Technical details
The vulnerability is a race condition in the service downgrade handler (`app/Livewire/Services/Upgrade.php::doUpgrade()`) that lacks transactional safety or database-level locking. The application checks for pending upgrades using an unisolated query, allowing concurrent requests to simultaneously observe no pending record and all proceed past the eligibility check. Each concurrent request then executes `$credit->increment()` independently, cumulatively inflating the user's refund amount by the number of parallel requests. An authenticated user can send multiple downgrade requests in parallel to trigger N refunds for a single service downgrade. The vulnerability requires the user to be authenticated and the service to be downgradable, but has no other preconditions. A patch would require wrapping the validation and credit update in a database transaction with row-level locking.
Affected products
- Paymenter Paymenter <UNKNOWN>
Timeline
- 2026-09-18: disclosed: Advisory published