Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Thelia before 3.1.5 and 3.2.x before 3.2.4 contains a business logic vulnerability that allows authenticated customers to bypass coupon usage limits because usage is counted only when orders become paid. Attackers can place multiple pay-later orders while a usage remains, or cancel paid orders to inflate max_usage, gaining unlimited discounts.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
Another CVE assigned: CVE-2026-112285! https://www.cve.org/CVERecord?id=CVE-2026-112285 Older reports are slowly getting triaged and published. For now, I'm focused on completing the #CWES path. #CVE #CyberSecurity #VulnerabilityResearch