CVE-2026-112285
MEDIUM
CVSS 4.3
Published: 2026-10-19
Modified: 2026-10-19
Tenable Plugin
Checking the public Tenable catalog…
Threat Intelligence Pending
IOCs, MITRE ATT&CK techniques, and attack chain data are being generated. Refresh in a few seconds.
Description
Thelia before 3.1.5 and 3.2.x before 3.2.4 contains a business logic vulnerability that allows authenticated customers to bypass coupon usage limits because usage is counted only when orders become paid. Attackers can place multiple pay-later orders while a usage remains, or cancel paid orders to inflate max_usage, gaining unlimited discounts.
Quick Facts
| CVE ID | CVE-2026-112285 |
| CVSS Score | 4.3 |
| Vector | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N |
| Published | 2026-10-19 |
| Exploited | No |
| CISA KEV | No |
| PoC | Not public |
References
- https://github.com/thelia/thelia/blob/3.2.3/core/lib/Thelia/…
- https://github.com/thelia/thelia/blob/3.2.3/core/lib/Thelia/…
- https://github.com/thelia/thelia/blob/3.2.3/core/lib/Thelia/…
- https://github.com/thelia/thelia/commit/1c3ed9c7ad57fec8ea95…
- https://github.com/thelia/thelia/commit/edb7078bfce5ea31b408…
- https://github.com/thelia/thelia/releases/tag/3.1.5
- https://github.com/thelia/thelia/releases/tag/3.2.4
- https://github.com/thelia/thelia/security/advisories/GHSA-pq…
- https://www.vulncheck.com/advisories/thelia-before-3.1.5-and…