A vulnerability in the Paymenter webshop solution allows authenticated attackers to bypass authorization controls, posing a significant risk to hosting service management.

The application suffers from improper input validation and authorization bypass through user-controlled keys. This flaw allows a user with authenticated access to manipulate parameters to gain unauthorized access to functions or data outside their intended scope.

The ability to bypass authorization controls can lead to unauthorized access to sensitive hosting account management features, potentially resulting in service disruption or data exposure. With a CVSS score of 8.5, this high-severity vulnerability represents a significant risk to the integrity of business operations and customer data management within the hosting platform.

Immediate Action: Update the Paymenter installation to version 1.5.1 or later to apply the necessary security patches.

Proactive Monitoring: Review application access logs for unusual patterns of request manipulation or unauthorized attempts to access administrative endpoints.

Compensating Controls: Implement strict Web Application Firewall (WAF) rules to filter and validate input parameters, specifically targeting requests that attempt to pass unauthorized identifiers.

Public Exploit Available: Unknown

Given the high CVSS score and the nature of the vulnerability, administrators must treat this as a priority update. Apply the latest version of Paymenter immediately to close the authorization gap and prevent potential exploitation by malicious actors.