Cloudanix VulnDB

GHSA-9rh9-hf3w-9fgg

Medium · 5.9

shopper/framework: Race condition on Discount.usage_limit allows silent over-redemption

CVSS

5.9

EPSS

—

Published

May 18, 2026

CISA due date

—

The record

`CreateOrderFromCartAction::execute` previously created the `Order` row before checking and incrementing the discount's `total_use` counter. Under concurrent checkout pressure (Black Friday, flash sale, viral coupon), the global `usage_limit` was silently exceeded: orders were committed with the discount fully applied to `price_amount` while the counter blocked at `usage_limit`. The merchant had no signal that an over-redemption had occurred. A second related bug: `usage_limit_per_user` was effectively a no-op because the counter it relied on (`DiscountDetail.total_use`) was never incremented anywhere in the codebase. The per-user check therefore always saw `0` uses and validation passed regardless of how many times the same customer had previously redeemed the coupon. For `eligibility = Everyone` the per-user limit could not fire at all because the underlying `DiscountDetail` row only exists for `eligibility = Customers`. Direct financial loss: each over-redemption is a discount the merchant did not intend to grant.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities