Race Condition in Coupon Redemption of Macrozheng Mall Software
CVE-2026-109407

2.3LOW

Key Information:

Vendor

Macrozheng

Status
Mall
Vendor
CVE Published:
13 October 2026

What is CVE-2026-109407?

A security vulnerability has been identified in the Macrozheng Mall software, particularly within the Coupon Redemption feature. It involves the file /order/generateOrder and is characterized by a race condition that arises from improper handling of the couponId argument. This vulnerability can be exploited remotely, but is assessed as difficult to exploit due to its complexity. The vendor has removed relevant GitHub issues regarding this vulnerability without further explanation, adding to the concern for users relying on this product.

Affected Version(s)

mall 1.0.0

mall 1.0.1

mall 1.0.2

References

https://vuldb.com/vuln/416949
vdb-entrytechnical-description
https://vuldb.com/vuln/416949/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-109407
third-party-advisory

CVSS V4

Score:
2.3
Severity:
LOW
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

peanutbutter (VulDB User)
VulDB CNA Team
.