CVE-2026-112285 — Thelia before 3.1.5 and 3.2.4 Coupon Usage Limit Bypass via Pay-Later Orders
Thelia before 3.1.5 and 3.2.x before 3.2.4 contains a business logic vulnerability that allows authenticated customers to bypass coupon usage limits because usage is counted onl…
Published: 2026-10-19 · CVSS: 5.3 · CVSS 4.0
Thelia before 3.1.5 and 3.2.x before 3.2.4 contains a business logic vulnerability that allows authenticated customers to bypass coupon usage limits because usage is counted only when orders become paid. Attackers can place multiple pay-later orders while a usage remains, or cancel paid orders to inflate max_usage, gaining unlimited discounts.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7