The vulnerability in Paymenter (CVE-2026-55219) arises because the application calls lockForUpdate() on the user's credit balance row outside of a database transaction. Since MySQL/MariaDB row-level locks require an active transaction to be effective, the lock is ignored. This race condition allows two or more concurrent payment requests to see the same credit balance and approve payments simultaneously, resulting in credit double-spend. The payments are processed successfully, causing direct financial or resource loss to the platform.

Authenticated users with a valid credit balance can exploit this race condition to pay multiple invoices using the same credit balance, bypassing intended balance restrictions. This leads to direct financial loss or unauthorized provisioning of services or digital goods to the attacker.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid concurrent payment requests or implement application-level synchronization to ensure credit balance updates are atomic within transactions.