Business Logic Vulnerability in Thelia Affects Coupon Usage Limits

CVE-2026-112285

What is CVE-2026-112285?

Thelia products prior to version 3.1.5 and 3.2.4 contain a business logic flaw that allows authenticated users to bypass coupon usage limits. This occurs because the coupon usage is only tracked when orders are marked as paid. Consequently, attackers can exploit this vulnerability by placing multiple pay-later orders while a coupon is still usable. By canceling previously paid orders, they can effectively inflate the usage count, enabling them to gain unlimited discounts.

References