CVE-2026-47741: Shopper Discount Over-Redemption Race Condition (MEDIUM)

Technical summary

The vulnerability exists in CreateOrderFromCartAction::execute, which commits the Order row with the discount applied before atomically checking and incrementing the discount's total_use counter. This race condition manifests under concurrent load: Thread A and Thread B both read usage_limit=100 and current counter at 99, both proceed to create orders with the discount applied, and both attempt to increment the counter. Due to the order of operations, both succeed in writing orders while the counter atomically increments to 101, exceeding the limit. The absence of a pre-check or transactional guard between discount validation and order persistence allows silent over-redemption.

Business impact

Undetected coupon over-redemption directly erodes profit margins on high-traffic sales events. A single flash sale or viral coupon campaign can result in hundreds or thousands of discounts applied beyond the planned usage cap, with no audit trail or immediate notification to the merchant. This creates reconciliation friction and trust issues with finance teams, and potential customer service disputes if merchants attempt retroactive chargebacks or order cancellations.

Affected systems

Shopper versions prior to 2.8.0 are vulnerable. The exact scope of deployed instances is unknown, but any Shopper installation used in e-commerce operations with concurrent checkout traffic and discount campaigns is at risk.

Exploitability

Exploitation does not require authentication, special privileges, or user interaction—it occurs naturally during normal concurrent checkout under promotional pressure. An attacker need not craft a special payload; the race condition triggers organically when multiple legitimate customers attempt to redeem the same limited-use discount simultaneously. The requirement for concurrent timing (AC:H in CVSS) means exploitation is not trivial to orchestrate deliberately, but it will occur reliably during organic traffic spikes. No public exploit code is known to exist.

Remediation

Upgrade Shopper to version 2.8.0 or later, which fixes the race condition by ensuring the discount counter is checked and incremented atomically before the Order is committed. Organizations unable to upgrade immediately should consider temporarily disabling high-traffic coupon campaigns or implementing manual monitoring of discount redemption logs to detect over-redemption.

Patch guidance

Apply Shopper 2.8.0 or later. Verify the version in your deployment; the fix changes the transaction scope of CreateOrderFromCartAction::execute to include the counter increment before order persistence. No configuration changes or data migration are required post-patch. Test the patch in a staging environment under simulated concurrent load before production deployment to confirm the race condition is eliminated.

Detection guidance

Review order and discount logs for the period before upgrading. Cross-reference order timestamps and applied discounts against the discount's declared usage_limit; if the number of orders exceeding the limit correlates with high-traffic periods, over-redemption likely occurred. Monitor application logs for any concurrent transaction conflicts or counter-lock timeouts during checkout. Post-patch, establish ongoing reconciliation checks comparing applied discount counts to configured limits on a per-coupon basis.

Why prioritize this

Although the CVSS score is MEDIUM (5.9), the business impact is material and the exploitability is high in real-world e-commerce conditions. Any organization running Shopper with active discount campaigns should prioritize the upgrade to 2.8.0. The vulnerability directly manifests during peak revenue events (Black Friday, flash sales), making delayed patching a compounding financial risk.

Risk score, explained

CVSS 5.9 reflects confidentiality impact of None, integrity impact of High (discounts are applied incorrectly), and availability impact of None. The network-accessible vector (AV:N) and lack of authentication (PR:N, UI:N) are offset by the requirement for concurrent timing (AC:H), which lowers severity from HIGH to MEDIUM. However, the integrity issue is material: merchants' revenue controls are compromised.

Frequently asked questions