Paymenter
Monthly
Concurrent downgrade requests against Paymenter 1.5.6 and earlier can double-spend account credit: any authenticated customer with an active, downgradable service can fire parallel requests that each pass the unpinned Service::upgradable check and each credit the same balance, yielding N refunds for one downgrade. The inflated balance is real, spendable store credit, so an attacker can immediately settle invoices or provision services at the operator's expense; no public exploit code or confirmed active exploitation was identified at time of analysis, and the independent assessment rates this a moderate-severity business-logic flaw rather than a system-compromise vector, since it requires a qualifying service, the default credits-on-downgrade setting, and a race window that must be won. Vendor-released patch: 1.5.7.
Concurrent downgrade requests against Paymenter 1.5.6 and earlier can double-spend account credit: any authenticated customer with an active, downgradable service can fire parallel requests that each pass the unpinned Service::upgradable check and each credit the same balance, yielding N refunds for one downgrade. The inflated balance is real, spendable store credit, so an attacker can immediately settle invoices or provision services at the operator's expense; no public exploit code or confirmed active exploitation was identified at time of analysis, and the independent assessment rates this a moderate-severity business-logic flaw rather than a system-compromise vector, since it requires a qualifying service, the default credits-on-downgrade setting, and a race window that must be won. Vendor-released patch: 1.5.7.