CVE-2026-109407
3.1LowPublished 13 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- Low
- User interaction
- None
- Impact
- Limited impact
- Weakness
- CWE-362
Impact
Authenticated remote attackers can improperly redeem coupons multiple times to lower order totals. Exploitation requires network access, a valid low-privilege user account, and precise timing during concurrent requests.
Root cause
A race condition in the `/order/generateOrder` endpoint fails to synchronize the `couponId` redemption check before generating orders.
Affected systems
macrozheng mall up to 1.0.3
CVSS v3.1 · CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
Fix & remediation
No official patched release or vendor mitigation is currently documented. Restrict access to the `/order/generateOrder` endpoint or implement concurrency locking in code around coupon redemption logic.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
A security vulnerability has been detected in macrozheng mall up to 1.0.3. This issue affects some unknown processing of the file /order/generateOrder of the component Coupon Redemption. Such manipulation of the argument couponId leads to race condition. The attack may be performed from remote. The attack requires a high level of complexity. The exploitability is assessed as difficult. The vendor deleted the GitHub issue for this vulnerability without any explanation.