CVE-2026-112285
Description
A flaw was found in Thelia. A remote authenticated customer can bypass coupon usage limits to obtain unauthorized discounts. This issue occurs because promotional coupon usage is only recorded when an order is marked as paid rather than when it is placed. Consequently, an attacker can submit multiple deferred-payment orders or cancel completed orders to repeatedly exploit single-use or limited promotional coupons.
Statement
This vulnerability is rated as having a Moderate impact because it requires valid customer credentials and only allows an attacker to manipulate promotional discount limits, with no ability to execute code, compromise server confidentiality, or disrupt service availability. Red Hat products do not distribute or package Thelia, meaning standard Red Hat environments are not directly affected by this issue. Consequently, exposure is limited to environments where third-party PHP application instances are deployed independently.
Understanding the Weakness (CWE)
Other
Technical Impact: Alter Execution Logic; Unexpected State
By performing actions in an unexpected order, or by omitting steps, an attacker could manipulate the business logic of the product or cause it to enter an invalid state. In some cases, this can also expose resultant weaknesses with security implications.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
