CVE-2026-112285

A flaw was found in Thelia. A remote authenticated customer can bypass coupon usage limits to obtain unauthorized discounts. This issue occurs because promotional coupon usage is only recorded when an order is marked as paid rather than when it is placed. Consequently, an attacker can submit...