MedusaJS Medusa up to 2.12.2 Promotion registerUsage race condition

Summaryinfo

A vulnerability identified as problematic has been detected in MedusaJS Medusa up to 2.12.2. This impacts the function registerUsage of the component Promotion Module. Performing a manipulation results in race condition. This vulnerability is known as CVE-2025-69871. Remote exploitation of the attack is possible. No exploit is available. It is suggested to install a patch to address this issue.

Detailsinfo

A vulnerability, which was classified as problematic, was found in MedusaJS Medusa up to 2.12.2. This affects the function registerUsage of the component Promotion Module. The manipulation with an unknown input leads to a race condition vulnerability. CWE is classifying the issue as CWE-362. The product contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently. This is going to have an impact on integrity. The summary by CVE is:

A race condition vulnerability exists in MedusaJS Medusa v2.12.2 and earlier in the registerUsage() function of the promotion module. The function performs a non-atomic read-check-update operation when enforcing promotion usage limits. This allows unauthenticated remote attackers to bypass usage limits by sending concurrent checkout requests, resulting in unlimited redemptions of limited-use promotional codes and potential financial loss.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2025-69871 since 01/09/2026. The exploitability is told to be difficult. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details are known, but no exploit is available.

The vulnerability scanner Nessus provides a plugin with the ID 298788 (Linux Distros Unpatched Vulnerability : CVE-2025-69871), which helps to determine the existence of the flaw in a target environment.

Applying a patch is able to eliminate this problem. The bugfix is ready for download at github.com.

The vulnerability is also documented in the vulnerability database at Tenable (298788). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• MedusaJS

Name

• Medusa

Version

• 2.12.0
• 2.12.1
• 2.12.2

Website

• Product: https://github.com/medusajs/medusa/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion