CVE-2026-121628
Bagisto before 2.3.16 and 2.4.x before 2.4.1 Race Condition in Coupon Usage Accounting
CVSS Score
3.7
EPSS Score
0.0%
EPSS Percentile
0th
Bagisto before 2.3.16 and 2.4.x before 2.4.1 contains a race condition vulnerability in manageCartRule() that allows attackers to redeem single-use coupons multiple times. Attackers can submit concurrent order requests to the onepage orders checkout endpoint, bypassing unlocked times_used checks to apply discounts repeatedly.
| CWE | CWE-362 |
| Vendor | bagisto |
| Product | bagisto |
| Published | Nov 3, 2026 |
Stay Ahead of the Next One
Get instant alerts for bagisto bagisto
Be the first to know when new low vulnerabilities affecting bagisto bagisto are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
None
Affected Versions
bagisto / bagisto
0 < 2.3.16 2.4.0 < 2.4.1
References
github.com: https://github.com/bagisto/bagisto/commit/81cb2a2a35b355492f704fd216d679f2145a5650 github.com: https://github.com/bagisto/bagisto/commit/1f57c10eb9cb61b37de4706ffa439fd26aa7c405 github.com: https://github.com/bagisto/bagisto/releases/tag/v2.3.16 github.com: https://github.com/bagisto/bagisto/releases/tag/v2.4.1 gist.github.com: https://gist.github.com/Ayxpp/5358d9fff045e94e0ddb51677ed5d195 github.com: https://github.com/bagisto/bagisto/blob/v2.4.0/packages/Webkul/CartRule/src/Listeners/Order.php#L30-L95 github.com: https://github.com/bagisto/bagisto vulncheck.com: https://www.vulncheck.com/advisories/bagisto-before-2.3.16-and-2.4-x-before-2.4.1-race-condition-in-coupon-usage-accounting
Credits
Muhammad Shariff devansh-webkul