OpenMage magento-lts up to 20.18.x/21.0.0-beta2 Shopping Cart Price Rule Mage_SalesRule_Model_Validator race condition

Summaryinfo

A vulnerability, which was classified as problematic, has been found in OpenMage magento-lts up to 20.18.x/21.0.0-beta2. This affects the function Mage_SalesRule_Model_Validator of the component Shopping Cart Price Rule. The manipulation leads to race condition. This vulnerability is referenced as CVE-2026-128042. Remote exploitation of the attack is possible. No exploit is available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in OpenMage magento-lts up to 20.18.x/21.0.0-beta2 and classified as problematic. This issue affects the function Mage_SalesRule_Model_Validator of the component Shopping Cart Price Rule. The manipulation with an unknown input leads to a race condition vulnerability. Using CWE to declare the problem leads to CWE-362. The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently. Impacted is integrity. The summary by CVE is:

OpenMage magento-lts before 20.19.0 and 21.0.0-beta1 before 21.0.0-beta3 contains a race condition in shopping cart price rule usage limits, because Mage_SalesRule_Model_Validator checks coupon limits without locking and the usage counters are later incremented non-atomically. Unauthenticated attackers, including guest shoppers, can submit concurrent checkouts to redeem a limited coupon more times than its cap allows.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2026-128042 since 11/12/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 20.19.0 or 21.0.0-beta3 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• E-Commerce Management Software

Vendor

• OpenMage

Name

• magento-lts

Version

• 20.0
• 20.1
• 20.2
• 20.3
• 20.4
• 20.5
• 20.6
• 20.7
• 20.8
• 20.9
• 20.10
• 20.11
• 20.12
• 20.13
• 20.14
• 20.15
• 20.16
• 20.17
• 20.18
• 21.0.0-beta1
• 21.0.0-beta2

Website

• Product: https://github.com/OpenMage/magento-lts/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion