CVE-2026-55219

Name of the Vulnerable Software and Affected Versions Paymenter versions prior to 1.5.5

Description The credit payment implementation in app/Livewire/Invoices/Show.php executes a pessimistic row lock (lockForUpdate()) outside of an active database transaction. In database systems like MySQL and MariaDB, row-level locks require an enclosing transaction to be enforced; otherwise, the lock is ignored. This creates a race condition where concurrent payment requests can read the same credit balance simultaneously. If two requests are processed at the same time, both may see a sufficient balance and approve the payment through ExtensionHelper::addPayment(), allowing a user to settle multiple invoices using the same credit balance and resulting in financial or resource loss.

Recommendations Update to version 1.5.5.