CVE-2026-44584

描述

### Summary The email update functionality fails to invalidate the existing verification state when a user changes their email address, allowing a verified account to retain its verified status after switching to an unverified or unowned email address. ### Technical Details When a user updated their email address, the system did not reset or revalidate the associated email verification status. As a result, the verification column remained set to “true” even after the email address was changed. This allowed an attacker to: - Verify an account using a legitimate email address - Change the account email to an arbitrary or unowned address - Retain the verified status without re-confirmation of the new email No verification challenge or confirmation was required for the newly assigned email address. ### Impact This vulnerability allows a user to associate a verified account with an email address they do not control, this may result in: - Misrepresentation of email ownership - Bypass of verification-based trust assumptions - Potential abuse of features gated behind verified status No direct unauthorized access to other users accounts or data is possible through this issue alone.

如何修補 CVE-2026-44584

要修補 CVE-2026-44584,請將受影響套件升級到下列已修補版本。

• —升級至 1.5.0 或更新版本

CVE-2026-44584 正在被利用嗎?

目前沒有被利用訊號。CVE-2026-44584 既不在 CISA KEV 也沒有最新的 EPSS 分數。

受影響套件(1)

• from 0, < 1.5.0

CVSS 分數

參考連結(2)

• PATCHgithub.com/Paymenter/Paymenter
• WEBgithub.com/Paymenter/Paymenter/security/advisories/GHSA-rv89-wch8-c574