CVE-2026-121628Bagisto before 2.3.16 and 2.4.x before 2.4.1 Race Condition in Coupon Usage Accounting

Beschreibung

Bagisto before 2.3.16 and 2.4.x before 2.4.1 contains a race condition vulnerability in manageCartRule() that allows attackers to redeem single-use coupons multiple times. Attackers can submit concurrent order requests to the onepage orders checkout endpoint, bypassing unlocked times_used checks to apply discounts repeatedly.

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

Referenzen und Patches

• https://github.com/bagisto/bagisto/commit/81cb2a2a35b355492f704fd216d679f2145a5650 patch
• Patch Commit patch
• bagisto v2.3.16 Release Notes release-notes
• bagisto v2.4.1 Release Notes release-notes
• https://gist.github.com/Ayxpp/5358d9fff045e94e0ddb51677ed5d195 exploit
• https://github.com/bagisto/bagisto/blob/v2.4.0/packages/Webkul/CartRule/src/Listeners/Order.php#L30-L95 technical-description
• https://github.com/bagisto/bagisto product
• VulnCheck Advisory: Bagisto before 2.3.16 and 2.4.x before 2.4.1 Race Condition in Coupon Usage Accounting third-party-advisory