Race Condition in Payment Processing of Paymenter Webshop Solution

CVE-2026-55219

What is CVE-2026-55219?

Paymenter, a free and open-source webshop solution, is susceptible to a race condition in its payment processing system. In versions prior to 1.5.5, the implementation of credit payment in the application executes a pessimistic row lock outside of an active transaction. As a result, the MySQL/MariaDB database system does not enforce the intended row-level locks, allowing multiple payment requests to exploit this flaw. When two payment requests occur simultaneously, they can both perceive the same credit balance as sufficient, leading to potential financial losses when both payments are processed successfully. This vulnerability has been rectified in version 1.5.5.

References