Vulnerability · Published Jul 20, 2026 · Assigned by GitHub_M
CVE-2026-44584Paymenter doesn't reset email verification status after email change
Medium 4.3
In plain English
A medium-severity insufficient verification of data authenticity in Paymenter from Paymenter. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 6% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Paymenter is a free and open-source webshop solution for management of hosting services. In versions prior to 1.5.0, the email update functionality fails to invalidate the existing verification state when a user changes their email address, allowing a verified account to retain its verified status after switching to an unverified or unowned email address. When a user updated their email address, the system did not reset or revalidate the associated email verification status. As a result, the verification column remained set to “true” even after the email address was changed. Exploitation could potentially result in: misrepresentation of email ownership, bypass of verification-based trust assumptions, and abuse of features gated behind verified status. No direct unauthorized access to other users accounts or data is possible through this issue alone. This issue has been fixed in version 1.5.0.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | paymenter/paymenter | 1.5.0 | GHSA-rv89-wch8-c574 |
Affected products (as reported)
Weakness: CWE-345 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
References
- https://github.com/Paymenter/Paymenter/security/advisories/GHSA-rv89-wch8-c574 x_refsource_CONFIRM