Paymenter has a credit-refund double-spend race condition in service downgrade (doUpgrade)
Medium · CVSS 6.5
### Summary The service downgrade implementation in `app/Livewire/Services/Upgrade.php::doUpgrade()` executes a proration calculation and a subsequent user credit refund without any transactional safety or database locks. The only concurrency check relies on an unisolated database query checking for existing pending upgrades. Because there is no active database transaction or pessimistic row-level lock spanning this validation and the subsequent credit update, concurrent downgrade requests can bypass the guard simultaneously.
Remediation
Upgrade paymenter/paymenter to 1.5.7 or later.
Affected PHP branches
See the source advisory.
Source: GitHub Global Security Advisories (Composer ecosystem) · retrieved 2026-10-22T10:19:14-04:00 · https://github.com/advisories/GHSA-5gmm-hjfj-8ff7