CVE-2026-121628 in Bagisto
Summary
by MITRE • 11/03/2026
Bagisto before 2.3.16 and 2.4.x before 2.4.1 contains a race condition vulnerability in manageCartRule() that allows attackers to redeem single-use coupons multiple times. Attackers can submit concurrent order requests to the onepage orders checkout endpoint, bypassing unlocked times_used checks to apply discounts repeatedly.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 11/03/2026
The identified security flaw resides within the Bagisto e-commerce platform's cart rule management logic, specifically in the manageCartRule() function prior to versions 2.3.16 and 2.4.1. This vulnerability is classified as a race condition, which occurs when multiple processes or threads access shared data concurrently without proper synchronization mechanisms. In this specific context, the flaw allows attackers to exploit the timing gap between checking whether a single-use coupon has been redeemed and actually applying that redemption to an order. The core technical issue lies in the lack of atomic operations for validating and updating the usage count of coupons during high-concurrency checkout scenarios.
When a user initiates a purchase using a one-time use coupon, the system typically checks if the times_used counter is below its limit before proceeding with the transaction. However, because this check-and-update sequence is not executed atomically, an attacker can submit multiple concurrent requests to the onepage orders checkout endpoint simultaneously. These parallel requests may all pass the initial validation step where they observe that the coupon has not yet been used or exceeds zero remaining uses. Consequently, each request proceeds to apply the discount before any of them have updated the database record to reflect the new usage count. This effectively bypasses the intended single-use restriction, allowing the same coupon code to be redeemed multiple times in rapid succession.
The operational impact of this vulnerability is primarily financial and relates directly to business logic integrity. Attackers can systematically drain promotional budgets by repeatedly applying discounts that were designed for one-time use only. For e-commerce businesses relying on limited-time offers or single-use coupons as part of their marketing strategy, this flaw undermines the effectiveness of these campaigns and leads to direct revenue loss through unauthorized price reductions. Furthermore, such exploitation could potentially be used in conjunction with other vulnerabilities to facilitate fraud, although the primary impact here is the abuse of promotional pricing structures. The ability to bypass locked usage counts indicates a fundamental weakness in how state changes are handled under load within the application's checkout flow.
From a classification perspective, this vulnerability aligns closely with CWE-362, which describes concurrent execution using shared resources with improper synchronization. It also relates to CWE-841, Improper Enforcement of Behavioral Workflow, as the system fails to enforce the intended sequence of checking and updating coupon usage status atomically. In terms of adversary tactics, this exploitation technique mirrors aspects of ATT&CK Tactic TA0005, Defense Evasion, specifically through techniques that involve exploiting race conditions or timing attacks to bypass security controls designed to limit resource consumption or enforce policy constraints.
To mitigate this vulnerability, organizations running affected versions of Bagisto must upgrade immediately to version 2.3.16 or later for the 2.3.x branch, and version 2.4.1 or later for the 2.4.x branch. These releases contain patches that implement proper synchronization mechanisms within the manageCartRule() function. Developers should ensure that database transactions involving coupon validation and usage updates are wrapped in atomic operations to prevent concurrent requests from bypassing checks. Additionally, implementing rate limiting on checkout endpoints can provide an additional layer of defense by reducing the likelihood of successful race condition exploitation through high-volume parallel requests. Regular security audits focusing on transactional integrity in e-commerce workflows are recommended to identify similar patterns in other parts of the application logic.