Race Condition in Sylius eCommerce Framework Affecting Promotions and Coupons

CVE-2026-31824

What is CVE-2026-31824?

A race condition in the Sylius eCommerce Framework's promotion and coupon usage limit enforcement allows attackers to exploit concurrent requests, enabling the same limited-use offers to be redeemed multiple times without authentication. This vulnerability arises from a Time-of-Check to Time-of-Use flaw, where eligibility checks using in-memory doctrine entities fail to synchronize with the actual usage increment during order completion. As a result, multiple carts can use the same promotion, leading to potential financial losses for businesses through unlimited promotional redemptions.

References