CVE-2026-112285 in Thelia
Summary
by MITRE • 10/19/2026
Thelia before 3.1.5 and 3.2.x before 3.2.4 contains a business logic vulnerability that allows authenticated customers to bypass coupon usage limits because usage is counted only when orders become paid. Attackers can place multiple pay-later orders while a usage remains, or cancel paid orders to inflate max_usage, gaining unlimited discounts.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/19/2026
The identified security flaw resides within the e-commerce platform Thelia prior to versions 3.1.5 and 3.2.4, specifically affecting its coupon management subsystem. This vulnerability is classified as a business logic error rather than a traditional code injection or memory corruption issue. It exploits the temporal gap between order placement and payment confirmation in the transaction lifecycle. The core technical flaw lies in how the system tracks and enforces usage limits for promotional coupons. Instead of validating and decrementing coupon availability at the moment an order is created, Thelia defers this check until the financial status of the order transitions to paid. This design decision creates a race condition-like scenario where multiple orders can be instantiated against a single coupon instance before any payment verification occurs, effectively bypassing intended restrictions on usage frequency.
From an operational perspective, this vulnerability allows authenticated users with valid accounts to manipulate discount limits for significant financial gain. An attacker can exploit the pay-later functionality by placing numerous orders while the coupon remains in a pending state, thereby consuming multiple instances of what should be a single-use or limited-usage promotion. Furthermore, the logic flaw permits attackers to cancel previously paid orders after they have been processed. Since the system only decrements usage upon successful payment and may not properly revert or adjust limits upon cancellation depending on implementation specifics, this action can artificially inflate the remaining max_usage count for that coupon code. This mechanism enables users to generate unlimited discounts by repeatedly cycling through order placement and cancellation processes, leading to direct financial loss for merchants who cannot recover goods already shipped under fraudulent discount conditions.
This type of vulnerability aligns with CWE-840, which describes Business Logic Errors where the application fails to enforce intended business rules correctly. It also maps closely to MITRE ATT&CK technique T1536, specifically within the context of supply chain or e-commerce exploitation strategies involving abuse of legitimate features for unauthorized economic benefit. The attack vector requires authentication, meaning it is not remotely exploitable by anonymous users but poses a severe risk to any registered customer who may act maliciously or whose account has been compromised. The impact extends beyond simple financial theft; it undermines the integrity of promotional campaigns and can lead to significant inventory depletion if goods are shipped before fraud detection mechanisms trigger.
Mitigation strategies must focus on tightening the state management logic within the coupon engine. Developers should enforce usage limits at the point of order creation rather than waiting for payment confirmation, ensuring that a coupon is marked as used immediately upon checkout initiation regardless of subsequent payment status. Additionally, robust idempotency checks and transactional integrity measures are required to prevent double-ordering with the same session or user context within short timeframes. For organizations running affected versions, immediate upgrading to Thelia 3.1.5 or 3.2.4 is critical as these releases contain patches addressing this logic flaw. In the interim, implementing rate limiting on order creation endpoints and monitoring for anomalous patterns such as rapid successive orders followed by cancellations can help detect and block exploitation attempts before they result in substantial financial damage.