The vulnerability in Paymenter (CVE-2026-71537) arises from the doUpgrade() function in app/Livewire/Services/Upgrade.php, which processes service downgrades. The function performs a proration calculation and refunds user credits without wrapping these operations in a database transaction or applying row-level locks. The concurrency check relies on an unlocked read query to detect pending upgrades, which can be simultaneously passed by multiple concurrent requests. Each request inserts a pending upgrade record and increments the user's credit balance independently, resulting in multiple refunds for a single downgrade event. This race condition enables users to multiply their credit balance fraudulently.

Authenticated users with active, downgradable services can exploit this race condition to inflate their credit balance by multiple times the legitimate refund amount. The inflated credits are real and spendable within the platform, allowing immediate use to pay invoices or acquire additional services. This leads to direct financial and resource losses for the Paymenter operator. There is no indication of data confidentiality or availability impact.

A patch is available for this vulnerability. Operators should upgrade to Paymenter version 1.5.7 or later, where the issue is fixed by implementing proper transactional safety and database locking to serialize concurrent downgrade requests. Until patched, no reliable workaround is described. Users should apply the official fix to prevent exploitation.