CVE-2026-121628: Bagisto before 2.3.16 and 2.4.x before 2.4.1 Race Condition in Coupon Usage Accounting

Published Nov 3, 2026

Updated

Bagisto before 2.3.16 and 2.4.x before 2.4.1 contains a race condition vulnerability in manageCartRule() that allows attackers to redeem single-use coupons multiple times. Attackers can submit concurrent order requests to the onepage orders checkout endpoint, bypassing unlocked timesused checks to apply discounts repeatedly.

Event History

Nov 3, 2026

CVE Published

via MITRE·05:13 PM

Data Sourced

via MITRE·05:13 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·06:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which Bagisto versions need remediation?

Bagisto versions before 2.3.16 and 2.4.x versions before 2.4.1 are affected. Upgrade to 2.3.16 or, for the 2.4 branch, 2.4.1 or later.

What does an attacker need to exploit this issue?

The attacker needs to submit concurrent order requests to the onepage orders checkout endpoint while using a single-use coupon. No authentication or user interaction is required according to the supplied vector.

What is the practical impact of successful exploitation?

A successful attacker can redeem a coupon intended for one use multiple times by racing the coupon usage accounting check. The stated impact is repeated discount application; confidentiality and availability impact are not indicated.

CVE-2026-121628: Bagisto before 2.3.16 and 2.4.x before 2.4.1 Race Condition in Coupon Usage Accounting

Event History

Frequently Asked Questions

Which Bagisto versions need remediation?

What does an attacker need to exploit this issue?

What is the practical impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which Bagisto versions need remediation?

What does an attacker need to exploit this issue?

What is the practical impact of successful exploitation?