CVE-2026-112285GHSA-pq5m-7g9w-ppg8
Thelia before 3.1.5 and 3.2.4 Coupon Usage Limit Bypass via Pay-Later Orders
Thelia Thelia
CVSS
5.3MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.29%Chance of exploitation activity in the next 30 days, higher than 20% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
Thelia before 3.1.5 and 3.2.x before 3.2.4 contains a business logic vulnerability that allows authenticated customers to bypass coupon usage limits because usage is counted only when orders become paid. Attackers can place multiple pay-later orders while a usage remains, or cancel paid orders to inflate max_usage, gaining unlimited discounts.
Text from CVE List
Affected versions 2
- Theliaaffected: 2.6.2 before 3.1.5CVE List
- Theliaaffected: 3.2.0 before 3.2.4CVE List
References 9
- github.com/thelia/thelia/commit/1c3ed9c7ad57fec8ea959aa2d2f506f9892777eaFixvia CVE List
- github.com/thelia/thelia/commit/edb7078bfce5ea31b40868d340b0b49dcc6cf00cFixvia CVE List
- github.com/thelia/thelia/releases/tag/3.1.5Fixvia CVE List
- github.com/thelia/thelia/releases/tag/3.2.4Fixvia CVE List
- github.com/thelia/thelia/security/advisories/GHSA-pq5m-7g9w-ppg8Advisoryvia CVE List
- vulncheck.com/advisories/thelia-before-3.1.5-and-3.2.4-coupon-usage-limit-bypass-via-pay-later-ordersAdvisoryvia CVE List
- github.com/thelia/thelia/blob/3.2.3/core/lib/Thelia/Domain/Promotion/Coupon/Service/OrderCouponUsageManager.phpReferencevia CVE List
- github.com/thelia/thelia/blob/3.2.3/core/lib/Thelia/Domain/Promotion/Coupon/Service/CouponManager.phpReferencevia CVE List
- github.com/thelia/thelia/blob/3.2.3/core/lib/Thelia/Action/Coupon.phpReferencevia CVE List