CVE-2026-112285

Name of the Vulnerable Software and Affected Versions Thelia versions prior to 3.1.5 Thelia versions 3.2.x prior to 3.2.4

Description A business logic flaw allows authenticated customers to bypass coupon usage limits. This occurs because the system only counts coupon usage once orders are marked as paid. An attacker can exploit this by placing multiple pay-later orders while a usage limit is still available or by canceling previously paid orders to artificially increase the max usage count, resulting in unlimited discounts.

Recommendations Update to version 3.1.5 or later. Update to version 3.2.4 or later.