4 matches found
CVE-2026-121628
Bagisto before 2.3.16 and 2.4.x before 2.4.1 contains a race condition vulnerability in manageCartRule that allows attackers to redeem single-use coupons multiple times. Attackers can submit concurrent order requests to the onepage orders checkout endpoint, bypassing unlocked timesused checks to...
EUVD-2026-116103
Bagisto before 2.3.16 and 2.4.x before 2.4.1 contains a race condition vulnerability in manageCartRule that allows attackers to redeem single-use coupons multiple times. Attackers can submit concurrent order requests to the onepage orders checkout endpoint, bypassing unlocked timesused checks to...
CVE-2026-121628 Bagisto before 2.3.16 and 2.4.x before 2.4.1 Race Condition in Coupon Usage Accounting
Bagisto before 2.3.16 and 2.4.x before 2.4.1 contains a race condition vulnerability in manageCartRule that allows attackers to redeem single-use coupons multiple times. Attackers can submit concurrent order requests to the onepage orders checkout endpoint, bypassing unlocked timesused checks to...
CVE-2026-121628
The Bagisto e-commerce platform, specifically versions before 2.3.16 and 2.4.x before 2.4.1 , is vulnerable to a race condition in the manageCartRule() function. This flaw allows an attacker to bypass times_used checks by submitting concurrent order requests to the one-page orders checkout endpoi...