EUVD-2026-46090
GHSA-x93q-x9pc-w5hw
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Requires authenticated customer session (PR:L) and trivial HTTP parameter substitution (AC:L); no direct data retrieval caps confidentiality and integrity at Low, with no availability impact.
Primary rating from Vendor (https://github.com/Paymenter/Paymenter).
CVSS VectorVendor: https://github.com/Paymenter/Paymenter
Lifecycle Timeline
2DescriptionCVE.org
Summary
The ticket creation endpoint accepts a user-supplied service identifier without enforcing ownership validation, allowing authenticated users to create support tickets referencing services belonging to other accounts by modifying the service ID in the request.
Technical Details
The ticket creation endpoint accepted a user-supplied service identifier without verifying ownership or authorization against the authenticated account. An attacker could modify the service ID value in the client-side request and successfully create a ticket associated with another user's service.
The vulnerability required authentication and did not provide direct access to service contents or customer data. However, referenced service information could become visible to support personnel handling the ticket.
Impact
Successful exploitation could allow an authenticated user to:
- Create support tickets referencing services belonging to other users
- Potentially cause support staff to interact with or review unrelated customer services
The vulnerability did not allow:
- Direct access to another user's service
- Modification of another user's service
- Retrieval of confidential service data through the vulnerable endpoint itself
AnalysisAI
Broken object level authorization (BOLA) in Paymenter's ticket creation endpoint allows any authenticated customer to reference another account's service by substituting the service ID in the HTTP request, causing support personnel to inadvertently review that third-party service. The flaw affects all Paymenter installations running versions prior to 1.5.0 (pkg:composer/paymenter/paymenter). No confirmed active exploitation (not in CISA KEV) and no public exploit code has been identified at time of analysis, but the attack requires only a valid customer account and basic HTTP manipulation, making real-world abuse accessible to low-sophistication actors.
Technical ContextAI
Paymenter is an open-source hosting and billing management panel distributed as a PHP Composer package (pkg:composer/paymenter/paymenter). The flaw is rooted in CWE-862 (Missing Authorization), specifically a broken object level authorization (BOLA) pattern - also known as IDOR - in which the server-side ticket creation handler accepts a user-supplied service_id parameter without verifying that the authenticated session's account actually owns the referenced service. Because authorization is absent rather than bypassable, this is a server enforcement gap rather than an authentication weakness; the 'Authentication Bypass' tag in the metadata is a mislabeling. Any client-side HTTP interceptor (Burp Suite, browser devtools) can substitute an arbitrary service ID. Affected CPE: pkg:composer/paymenter/paymenter, all releases before 1.5.0.
RemediationAI
Upgrade Paymenter to version 1.5.0 or later, which is the vendor-confirmed fixed release per GHSA-x93q-x9pc-w5hw (https://github.com/Paymenter/Paymenter/security/advisories/GHSA-x93q-x9pc-w5hw). For operators unable to patch immediately, a compensating control is to implement server-side middleware or WAF rules that cross-validate the submitted service_id against the authenticated session's account before the ticket creation handler processes the request - however, this requires custom integration and is not a substitute for the upstream patch. Alternatively, temporarily disabling the ability to associate a service with a ticket at the application configuration level eliminates the attack surface at the cost of reduced support workflow efficiency. No additional workarounds are documented in the vendor advisory.
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today