Thelia CVE-2026-112285

Requires a valid authenticated customer account (PR:L) on a Thelia store running a vulnerable version (before 3.1.5, or 3.2.x before 3.2.4) that has an active coupon configured with a finite usage limit (global max_usage or per-customer usage count). The flaw is reachable only because usage is counted at the paid-order transition, so exploitation specifically depends on the store offering a deferred/'pay-later' payment flow (allowing orders to sit unpaid while usage remains) or permitting order cancellation of paid orders to give usage back. Limiting factors: attacker must hold a store account, a usage-capped coupon must exist, and the store must support pay-later or cancellation workflows; there is no confidentiality or availability impact, and impact is confined to discount/order-accounting integrity.

This is a business logic / improper enforcement flaw (CWE-837) carrying a moderate CVSS 4.0 base score of 5.3. The provided 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N) shows a remotely reachable, low-complexity issue requiring low privileges (an authenticated customer account), with no confidentiality or availability impact and only LOW integrity impact - matching the nature of the bug (manipulating coupon usage accounting, not system compromise). No EPSS probability, CISA KEV listing, or public POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the only exploitation enabler supplied is the fix commit diff, which reveals the root cause but is not weaponized exploit code. The realistic risk is financial/fraud-oriented and merchant-specific (abuse of discount limits), not a server-takeover priority: it ranks below network RCE despite being trivially performed by any registered user. Note a data-quality signal: the input Tag 'Authentication Bypass' conflicts with the description and CWE - this is a limit-bypass by an ALREADY-authenticated customer, not a bypass of authentication - so that tag should not drive triage. The fix diff also exposes a secondary race-condition angle ('two orders paid at the same time never share the last usage'), which raises the practical exploitability slightly beyond the pure pay-later/cancel logic path.

An attacker registers or uses an existing customer account on a Thelia store and applies a coupon that has a limited number of uses. Because usage is only decremented when an order becomes paid, the attacker either places several 'pay-later' (deferred payment) orders while a usage still shows as available, or cancels already-paid orders to restore/inflate max_usage, redeeming the capped discount far beyond its intended limit. No public exploit code was identified; exploitation requires only a valid customer login and is low-complexity.