Paymenter up to 1.4.x ticket creation endpoint service ID authorization

Summaryinfo

A vulnerability has been found in Paymenter up to 1.4.x and classified as problematic. The impacted element is an unknown function of the component ticket creation endpoint. This manipulation of the argument service ID causes authorization. This vulnerability is handled as CVE-2026-44585. The attack can be initiated remotely. There is not any exploit available.

Detailsinfo

A vulnerability was found in Paymenter up to 1.4.x. It has been declared as problematic. Affected by this vulnerability is an unknown part of the component ticket creation endpoint. The manipulation of the argument service ID with an unknown input leads to a authorization vulnerability. The CWE definition for the vulnerability is CWE-639. The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data. As an impact it is known to affect confidentiality. The summary by CVE is:

Paymenter is a free and open-source webshop solution for management of hosting services. In versions prior to 1.5.0, the ticket creation endpoint accepts a user-supplied service identifier without enforcing ownership validation, allowing authenticated users to create support tickets referencing services belonging to other accounts by modifying the service ID in the request. An attacker could modify the service ID value in the client-side request and successfully create a ticket associated with another user's service. The vulnerability requires authentication and does not provide direct access to service contents or customer data. However, referenced service information could become visible to support personnel handling the ticket. Successful exploitation could allow an authenticated user to: create support tickets referencing services belonging to other users, potentially cause support staff to interact with or review unrelated customer services. The vulnerability did not allow direct access to another user's service, modification of another user's service or retrieval of confidential service data through the vulnerable endpoint itself. This issue has been fixed in version 1.5.0.

The advisory is shared at github.com. This vulnerability is known as CVE-2026-44585 since 05/06/2026. The exploitation appears to be easy. The attack can be launched remotely. It demands that the victim is doing some kind of user interaction. Technical details are known, but no exploit is available.

Upgrading to version 1.5.0 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Name

• Paymenter

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4

Website

• Product: https://github.com/Paymenter/Paymenter/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion