CVE-2026-71537: 
PHP 취약성 분석 및 완화

CVE-2026-71537 is a credit-refund double-spend race condition in Paymenter, a free and open-source hosting service management webshop. The vulnerability exists in app/Livewire/Services/Upgrade.php::doUpgrade() and allows authenticated customers to trigger multiple credit refunds for a single service downgrade by submitting concurrent requests. It affects all Paymenter versions up to and including 1.5.6, and was fixed in version 1.5.7. The advisory was originally published on August 13, 2026, and added to the GitHub Advisory Database on September 18, 2026. It carries a CVSS v3.1 base score of 6.5 (Medium) (Github Advisory).

The root cause is a classic Time-of-Check to Time-of-Use (TOCTOU) race condition (CWE-362) in the doUpgrade() method. The application checks for a pending upgrade using an unlocked read (Service::upgradable) without wrapping the check and subsequent credit update in a DB::transaction or using lockForUpdate(). As a result, multiple concurrent HTTP requests can each observe no pending upgrade at the same millisecond, pass the eligibility check, independently insert their own ServiceUpgrade records, and each execute $credit->increment('amount', abs($price)), cumulatively inflating the user's credit balance by N times the legitimate refund amount. The fix (commit a42e7f8) wraps the entire operation in DB::beginTransaction() and applies lockForUpdate() on both the service and user rows before re-validating eligibility (Github Advisory, Patch Commit).

Successful exploitation allows any authenticated customer with an active, downgradable service to arbitrarily inflate their spendable account credit balance. The inflated credits function as real store credit and can be immediately used to pay future platform invoices or provision additional services at no cost, resulting in direct financial and resource loss to the platform operator. There is no confidentiality or availability impact; the integrity impact is high due to unauthorized manipulation of financial account balances (Github Advisory).

No public proof-of-concept exploit code has been identified, and there is no evidence of in-the-wild exploitation at this time. The vulnerability requires only a low-privilege authenticated account and low attack complexity, making it accessible to any registered customer on an affected platform. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (Github Advisory).

1. Obtain an authenticated account: Register or log in as a customer on a Paymenter instance running version 1.5.6 or earlier.
2. Identify a downgradable service: Locate an active service in the account that is eligible for downgrade (i.e., the target product has a lower price than the current plan, resulting in a negative price/credit refund).
3. Prepare concurrent requests: Using a tool such as curl, a custom script, or a race condition testing tool (e.g., Burp Suite's Turbo Intruder), prepare multiple identical HTTP POST requests targeting the doUpgrade() Livewire endpoint with the downgrade parameters.
4. Send requests simultaneously: Fire all prepared requests in parallel within the same millisecond window so that each request reads the database before any pending upgrade record is inserted by another request.
5. Observe credit inflation: Each concurrent request passes the eligibility check, inserts its own ServiceUpgrade record, and increments the credit balance. The account balance is inflated by N × refund amount, where N is the number of successful concurrent requests.
6. Spend inflated credits: Use the artificially inflated credit balance to pay for new services or invoices on the platform at no real cost (Github Advisory, Patch Commit).

• Database: Multiple ServiceUpgrade records with status = PENDING for the same service_id created within milliseconds of each other.
• Database: Abnormally large or rapidly increasing amount values in the user credits table for a single currency_code within a short time window.
• Logs: Multiple simultaneous or near-simultaneous POST requests to the Paymenter Livewire doUpgrade endpoint from the same authenticated session or user ID in application/web server access logs.
• Application Behavior: A user's credit balance significantly exceeding the expected proration refund for a single downgrade event.
• Audit Trail: Multiple ServiceUpgrade insert events for the same service in the application's event/audit log within the same second (Github Advisory).

Operators should upgrade Paymenter to version 1.5.7 immediately, which wraps the doUpgrade() logic in a DB::transaction with lockForUpdate() on both the service and user rows, preventing concurrent requests from bypassing the eligibility check. No configuration-based workaround is available for unpatched versions; upgrading is the only effective remediation. As an interim measure, operators may consider monitoring credit balance changes for anomalies and temporarily disabling the service downgrade feature if upgrading is not immediately possible (Github Advisory, v1.5.7 Release).