CVE-2026-121628— Bagisto before 2.3.16 and 2.4.x before 2.4.1 Race Condition in Coupon Usage Accounting

Quick assessment

Affected

bagisto bagisto

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Bagisto 2.3.16 之前的版本以及 2.4.x 系列中 2.4.1 之前的版本中，函数存在竞态条件漏洞，攻击者可借此多次使用仅限一次的优惠券。攻击者可以向“一步式结账”（onepage orders）接口并发提交订单请求，从而绕过尚未锁定的检查，重复应用折扣。

CVSS 3.7 · Low Updated Nov 04, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 4

Vendor	Product	Version Range	Status
bagisto	bagisto	`< 2.3.16`	affected
		`2.4.0< 2.4.1`	affected
		`2.3.16`	unaffected
		`2.4.1`	unaffected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Bagisto before 2.3.16 and 2.4.x before 2.4.1 Race Condition in Coupon Usage Accounting

Source: CVE Program / CVE List V5

Vulnerability Description

Bagisto before 2.3.16 and 2.4.x before 2.4.1 contains a race condition vulnerability in manageCartRule() that allows attackers to redeem single-use coupons multiple times. Attackers can submit concurrent order requests to the onepage orders checkout endpoint, bypassing unlocked times_used checks to apply discounts repeatedly.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

使用共享资源的并发执行不恰当同步问题(竞争条件)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
bagisto	bagisto	0 ~ 2.3.16	-

II. Public POCs for CVE-2026-121628

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-121628

请登录查看更多情报信息。

Other References for CVE-2026-121628 (8)

https://github.com/bagisto/bagisto/blob/v2.4.0/packages/Webkul/CartRule/src/Listeners/Order.php#L30-L95 technical-description
https://github.com/bagisto/bagisto/commit/81cb2a2a35b355492f704fd216d679f2145a5650 patch
https://github.com/bagisto/bagisto product
https://gist.github.com/Ayxpp/5358d9fff045e94e0ddb51677ed5d195 exploit
https://github.com/bagisto/bagisto/commit/1f57c10eb9cb61b37de4706ffa439fd26aa7c405 patch
https://github.com/bagisto/bagisto/releases/tag/v2.4.1 release-notes
https://github.com/bagisto/bagisto/releases/tag/v2.3.16 release-notes
https://www.vulncheck.com/advisories/bagisto-before-2.3.16-and-2.4-x-before-2.4.1-race-condition-in-coupon-usage-accounting third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-121628

IV. Related Vulnerabilities

Same product: bagisto

Same vendor: bagisto

Same weakness: CWE-362