EUVD-2026-45423
GHSA-5982-pmj5-rx9v
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessRegister or obtain low-privilege customer account
-
DeliveryScript parallel concurrent purchase requests for same product
-
ExploitRace condition window opens in inventory.py stock handler
-
ExecutionBoth requests pass availability check before decrement commits
-
ImpactInventory count corrupted or driven negative
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V15 - Secure Coding and Architecture Concurrency control, locking
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated user session with at minimum a registered customer account (CVSS PR:L). The attacker must be able to submit concurrent HTTP purchase requests targeting the same inventory item - this requires coordinated timing, typically via scripted parallel requests, making reliable exploitation moderately difficult (CVSS AC:H). The race condition only manifests when the application is served with multi-threaded or multi-process workers (e.g., gunicorn with multiple workers, uWSGI in threaded mode); single-threaded development servers are not exploitable. No special administrative privileges, non-default configurations, or platform-specific conditions beyond a running django-shop instance serving concurrent requests are required. Exploitation is limited to integrity and availability impact on inventory data - no confidentiality breach is possible per the CVSS VC:N assessment. |
| Impact | The CVSS 4.0 vector (AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L) scores 2.3, reflecting high attack complexity - the race window must be precisely timed and reliably hitting it requires concurrent request coordination. PR:L confirms exploitation requires an authenticated session (at minimum a registered customer account). Impact is limited to low integrity (stock count manipulation, potential overselling) and low availability (inventory data inconsistency). No confidentiality impact is assessed. The vulnerability is not listed in CISA KEV, indicating no confirmed mass exploitation. A public proof-of-concept (GitHub issue #888) exists, elevating the threat above purely theoretical, but AC:H substantially limits practical exploitation at scale. The primary real-world risk is inventory fraud - malicious buyers exploiting the race to purchase out-of-stock items - rather than systemic compromise. The vendor's lack of response is a compounding factor with no timeline for a fix. |
| Exploit ScenarioDerived | An authenticated attacker (or coordinated pair of buyer accounts) submits rapid-fire concurrent purchase requests for a product with exactly one unit of remaining stock. The race window in shop/models/inventory.py allows both requests to pass the availability check before either commits the decrement, resulting in both orders succeeding and inventory dropping to -1. A publicly available proof-of-concept at the GitHub issue demonstrates this timing attack. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 19, 2026
Race condition in awesto django-shop's Purchase Stock Handler allows a remotely authenticated attacker with low privileges to manipulate inventory data by triggering concurrent purchase requests. Affected versions span all releases up to and including 1.2.4. A publicly available proof-of-concept exists in the project's GitHub issue tracker, and the vendor has not responded to responsible disclosure - no patch has been released. EPSS data is absent, but the CVSS 4.0 score of 2.3 reflects the high attack complexity and limited impact scope.
RemediationAI
No vendor-released patch has been identified at time of analysis - the maintainer has not responded to the disclosure. As a primary compensating control, wrap stock decrement operations in database-level atomic transactions using Django's select_for_update() on the inventory queryset inside a transaction.atomic() block, which acquires a row-level lock and eliminates the TOCTOU window; this requires no framework changes and can be applied as a local patch. Alternatively, implement application-level distributed locking (e.g., Redis-based locks via django-redis) around the purchase stock handler to serialize concurrent requests for the same product. Restricting checkout concurrency via rate-limiting authenticated requests per user per product (e.g., using django-ratelimit on the purchase endpoint) reduces exploitation surface at the cost of degraded user experience under legitimate high load. Consider pinning to the most recently functional version and monitoring the upstream repository at https://github.com/awesto/django-shop/ for any future patch release.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
django-shop (CPE: cpe:2.3:a:awesto:django-shop:*:*:*:*:*:*:*:*) is a Python/Django-based e-commerce framework. The flaw resides in shop/models/inventory.py, specifically within the Purchase Stock Handler, which manages stock reservation and decrement during checkout. CWE-362 (Concurrent Execution Using Shared Resource with Improper Synchronization) identifies the root cause: the handler does not use atomic database operations or advisory locks to guard the read-modify-write sequence on inventory quantities, creating a classic time-of-check to time-of-use (TOCTOU) window. In a concurrent web environment served by multiple Django workers or threads, two simultaneous requests can both read the same stock quantity, both pass the availability check, and both decrement, resulting in oversold inventory or corrupted stock counts.
Know when Django Shop gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Network vector with high complexity reflects the race timing requirement; PR:L for required authenticated session; no confidentiality impact per VC:N in source vector.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability was identified in awesto django-shop up to 1.2.4. Affected is an unknown function of the file shop/models/inventory.py of the component Purchase Stock Handler. The manipulation leads to race condition. The attack is possible to be carried out remotely. The attack is considered to have high complexity. The exploitability is told to be difficult. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Race conditions occur when multiple concurrent requests exploit the brief time gap between checking a condition and acting upon it (TOCTOU - Time of Check, Time of Use).
Exploit-DB