CVE-2026-128042

medium

Description

OpenMage magento-lts before 20.19.0 and 21.0.0-beta1 before 21.0.0-beta3 contains a race condition in shopping cart price rule usage limits, because Mage_SalesRule_Model_Validator checks coupon limits without locking and the usage counters are later incremented non-atomically. Unauthenticated attackers, including guest shoppers, can submit concurrent checkouts to redeem a limited coupon more times than its cap allows.

References

https://www.vulncheck.com/advisories/openmage-magento-lts-before-20.19.0-race-condition-in-coupon-usage-limits

https://github.com/OpenMage/magento-lts/security/advisories/GHSA-5rg7-22cv-c9q6

https://github.com/OpenMage/magento-lts/commit/2626f027a752cda004c5cf7f8f9bd3cf52f525f2

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-125066

Details

Source: Mitre, NVD

Published: 2026-11-13

Updated: 2026-11-13

Risk Information

CVSS v2

Base Score: 2.6

Vector: CVSS2#AV:N/AC:H/Au:N/C:N/I:P/A:N

Severity: Low

CVSS v3

Base Score: 3.7

Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Severity: Low

CVSS v4

Base Score: 6.3

Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Severity: Medium

EPSS

EPSS: 0.00283