CVE-2026-112285
MEDIUM
5,3
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: low
User Interaction: none
Confidentiality: N/A
Integrity: N/A
Availability: N/A
MEDIUM
4,3
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: low
User Interaction: none
Scope: unchanged
Confidentiality: none
Integrity: low
Availability: none
Description
AI Translation Available
Thelia before 3.1.5 and 3.2.x before 3.2.4 contains a business logic vulnerability that allows authenticated customers to bypass coupon usage limits because usage is counted only when orders become paid. Attackers can place multiple pay-later orders while a usage remains, or cancel paid orders to inflate max_usage, gaining unlimited discounts.
EPSS (Exploit Prediction Scoring System)
Trend Analysis
EPSS (Exploit Prediction Scoring System)
Prevede la probabilità di sfruttamento basata su intelligence sulle minacce e sulle caratteristiche della vulnerabilità.
EPSS Score
0,0029
Percentile
0,2th
Updated
Single Data Point
Only one EPSS measurement is available for this CVE. Trend analysis requires multiple data points over time.
837
Improper Enforcement of a Single, Unique Action
IncompleteCommon Consequences
Security Scopes Affected:
Other
Potential Impacts:
Varies By Context
Applicable Platforms
Technologies:
Not Technology-Specific, Web Based, Web Server
https://github.com/thelia/thelia/blob/3.2.3/core/lib/Thelia/Action/Coupon.php
https://github.com/thelia/thelia/blob/3.2.3/core/lib/Thelia/Domain/Promotion/Co…
https://github.com/thelia/thelia/blob/3.2.3/core/lib/Thelia/Domain/Promotion/Co…
https://github.com/thelia/thelia/commit/1c3ed9c7ad57fec8ea959aa2d2f506f9892777ea
https://github.com/thelia/thelia/commit/edb7078bfce5ea31b40868d340b0b49dcc6cf00c
https://github.com/thelia/thelia/releases/tag/3.1.5
https://github.com/thelia/thelia/releases/tag/3.2.4
https://github.com/thelia/thelia/security/advisories/GHSA-pq5m-7g9w-ppg8
https://www.vulncheck.com/advisories/thelia-before-3.1.5-and-3.2.4-coupon-usage…