Shopper CVE-2026-47741

Exploitation of the global limit bypass requires at least one active discount code configured with a non-zero usage_limit in the target Shopper installation, and the ability to submit multiple simultaneous checkout requests applying that code - achievable with a scripted HTTP client, coordinated browser tabs, or simply by sharing a coupon publicly during a high-traffic event. No authentication is required per CVSS PR:N, as the checkout flow is customer-facing. The race window is narrow per request pair, making reliable single-attacker exploitation difficult at low request volume, but the concurrency threshold is inherently met during promotional events the merchant deliberately drives. Exploitation of the per-user limit bypass (usage_limit_per_user) requires only that the discount be configured with a per-user cap - no concurrency is needed, as the underlying DiscountDetail.total_use counter was never incremented in any code path, making every redemption appear as the customer's first regardless of history. For discounts with eligibility=Everyone, the per-user check cannot fire at all because no DiscountDetail row exists for that eligibility mode. Limiting factors for the global race: attack complexity is genuinely high at low traffic volumes; exploitation becomes reliable only when merchant-driven promotional load creates natural concurrency.

CVSS 5.9 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N) accurately classifies the network-accessible, unauthenticated attack surface with an Integrity:High impact reflecting unauthorized financial manipulation. The AC:H designation acknowledges the race window that must be won, but this rating can be misleading in practice: during promotional events that generate natural high-concurrency checkout traffic, the race becomes statistically reliable without any attacker-controlled infrastructure. No EPSS score was provided in the input data. The CVE is not in CISA KEV, and no public POC exploit code has been identified, indicating no confirmed active exploitation at time of analysis. Real-world financial risk is elevated for merchants running time-limited promotional campaigns - the exact traffic conditions that make exploitation reliable are also the conditions merchants deliberately create. The secondary per-user limit bug means that merchants who believed they had per-user caps as a safety net were entirely unprotected, compounding the integrity impact beyond what the global limit alone suggests. CVSS Confidentiality:N is confirmed - no data exfiltration vector is present. The 'Information Disclosure' tag in the source metadata appears to be a classification error inconsistent with both the description and the CVSS vector.

During a flash sale, an attacker distributes a limited-use coupon code or identifies one through normal shopping activity, then scripts dozens of simultaneous POST requests to the checkout endpoint - all applying the same coupon at the moment total_use approaches usage_limit. Because pre-2.8.0 Shopper reads total_use, validates, inserts the Order row, and only then increments the counter without database locking, multiple concurrent requests observe the same below-limit counter value, pass validation independently, and are all committed with the full discount applied. The merchant's usage_limit counter eventually reaches its ceiling, but significantly more orders than intended have already been stored with discounted price_amount values, representing direct and silent financial loss with no alert generated. No public POC exploit code has been identified at time of analysis.