PKSA-dth6-kz6z-9v4f: Promotion and coupon usage limit bypass via race condition

Q: What deployments should be reviewed?

Review deployments that include the composer/sylius/sylius package. The provided data does not identify affected or fixed versions, configuration prerequisites, or a workaround.

Published Oct 22, 2026

Updated

Promotion and coupon usage limit bypass via race condition

Affected Software

1 affected componentFixes available

composer/sylius/sylius>=2.3.0, <2.3.2

2.3.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade composer/sylius/sylius to a version that resolves this vulnerability.
Fixed in 2.3.2

Event History

Oct 22, 2026

Advisory Published

via Packagist·03:40 PM

Data Sourced

via Packagist·03:40 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What deployments should be reviewed?

Review deployments that include the composer/sylius/sylius package. The provided data does not identify affected or fixed versions, configuration prerequisites, or a workaround.

PKSA-dth6-kz6z-9v4f: Promotion and coupon usage limit bypass via race condition

Affected Software

Remediation

Event History

Frequently Asked Questions

What deployments should be reviewed?

Company

Resources

Contact

Frequently Asked Questions

What deployments should be reviewed?