CVE-2026-71537

Name of the Vulnerable Software and Affected Versions Paymenter versions prior to 1.5.7

Description A race condition exists in the service downgrade implementation within the doUpgrade() function of app/Livewire/Services/Upgrade.php. The application uses Service::upgradable to check for pending upgrades and subsequently executes $credit->increment('amount', abs($price)) to refund credits without using DB::transaction or lockForUpdate(). Because these operations are not isolated or locked, an authenticated customer with a downgradable service can send concurrent requests that bypass the safety check. This allows the user to trigger multiple credit refunds for a single downgrade, artificially inflating their spendable account balance.

Recommendations Update to version 1.5.7.