Vulnerability in Bagisto
CVE-2026-121628
Bagisto before 2.3.16 and 2.4.x before 2.4.1 contains a race condition vulnerability in manageCartRule() that allows attackers to redeem single-use coupons multiple times. Attackers can submit concurrent order requests to the onepage orders checkout endpoint, bypassing unlocked times_used checks to apply discounts repeatedly.
Vulnerability class: Race Condition
Published · last modified .
CVSS v3 metric
CVSS v3 base score 3.7 (Low). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N.
EPSS exploit prediction
No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.
Affected products
Weakness classification (CWE)
References
- github.com/bagisto/bagisto/commit/81cb2a2a35b355492f704fd216d679f2145a5650 (patch)
- github.com/bagisto/bagisto/commit/1f57c10eb9cb61b37de4706ffa439fd26aa7c405 (patch)
- github.com/bagisto/bagisto/releases/tag/v2.3.16 (release-notes)
- github.com/bagisto/bagisto/releases/tag/v2.4.1 (release-notes)
- gist.github.com/Ayxpp/5358d9fff045e94e0ddb51677ed5d195 (exploit)
- github.com/bagisto/bagisto/blob/v2.4.0/packages/Webkul/CartRule/src/Listeners/O… (technical-description)
- github.com/bagisto/bagisto (product)
- www.vulncheck.com/advisories/bagisto-before-2.3.16-and-2.4-x-before-2.4.1-race-… (third-party-advisory)
Frequently asked questions
- What is CVE-2026-121628?
- CVE-2026-121628 is a low-severity vulnerability in Bagisto, classified under Concurrent Execution using Shared Resource with Improper Synchronization (Race Condition). CVSS score: 3.7/10. Published 2026-11-03.
- How severe is CVE-2026-121628?
- Low severity. CVSS v3 base score is 3.7 out of 10.