Live › vulnerability › CVE-2026-112285
Go to dashboardThelia, an open-source e-commerce platform, counts coupon usage only when orders are paid, so a logged-in customer can place several pay-later orders while one use remains. Cancelling paid orders also raises the coupon's max_usage, letting the customer keep getting unlimited discounts.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Shops running Thelia 3.1 before 3.1.5 or 3.2 before 3.2.4 that offer coupons with a usage limit to customer accounts. Shops that do not use usage-limited coupons, or that run a patched version, are not exposed.
No product ranges from the sources yet.
3.1.5 or 3.2.x below 3.2.4 are affected.3.1.5 or later on the 3.1 line, or to 3.2.4 or later on the 3.2 line.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Thelia before 3.1.5 and 3.2.x before 3.2.4 contains a business logic vulnerability that allows authenticated customers to bypass coupon usage limits because usage is counted only when orders become paid. Attackers can place multiple pay-later orders while a usage remains, or cancel paid orders to inflate max_usage, gaining unlimited discounts.
This page as .md · .json · in your agent: get_signal("CVE-2026-112285")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.