Shopper EUVD-2026-33409

The vulnerability exists in the shopperlabs/shopper PHP Composer packages (shopper/cart and shopper/core), a Laravel-based headless e-commerce admin panel (CPE: cpe:2.3:a:shopperlabs:shopper:*:*:*:*:*:*:*:*). The root cause maps precisely to CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization). The CreateOrderFromCartAction::execute method performed a non-atomic check-then-act sequence: it read the discount's total_use value, validated it against usage_limit, committed the Order row to the database, and only then incremented total_use - without holding a database lock across these operations. This creates a TOCTOU window where multiple concurrent HTTP requests can simultaneously read the same pre-limit total_use value, all pass validation independently, and all commit orders with the discount applied before any counter increment is written. The fix in v2.8.0 wraps the entire sequence inside a DB::transaction using lockForUpdate with a compare-and-swap on total_use, making the reservation atomic and rolling back with DiscountLimitReachedException if the limit was exhausted between cart validation and commit. The secondary defect - DiscountDetail.total_use never being incremented - meant the per-user check perpetually observed 0 prior uses; for eligibility=Everyone discounts, the requisite DiscountDetail row did not even exist, making the per-user path entirely unreachable.