Executive brief
A vulnerability in the django-shop e-commerce framework allows for inventory overselling. Due to a flaw in how the system handles simultaneous transactions, multiple customers can successfully purchase the same final item in stock at the exact same time. This can lead to inaccurate inventory records and business operational issues where more orders are accepted than there is physical stock to fulfill.
Technical details
A race condition (CWE-362) exists in the Purchase Stock Handler component of django-shop, specifically within 'shop/models/inventory.py'. The checkout flow utilizes a non-atomic read-modify-write sequence to deduct inventory. While the process is wrapped in a database transaction, it fails to implement row-level locking (e.g., 'select_for_update()') or atomic conditional updates. A remote attacker with low privileges (a registered customer) can exploit this by sending concurrent POST requests to the checkout API, allowing multiple orders to be created for the same stock unit. As of the advisory date, the project has been informed but a formal patch has not been confirmed.
Affected products
- awesto django-shop up to 1.2.4
Timeline
- 2026-06-13: disclosed: Issue reported on GitHub repository
- 2026-07-19: advisory: CVE published by VulDB/NVD