# CVE-2026-43927: FOSSBilling race condition in cart checkout promo code validation

Source: https://junglewise.ai/threats/cve-2026-43927-fossbilling-race-condition-in-cart-checkout-promo-code-validation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-06. Updated: 2026-07-06  
License: CC BY 4.0 with a link back

CVE-2026-43927 · Severity: info · CVSS 6.9 · Published 2026-07-06

FOSSBilling is an open-source platform used by businesses to manage client billing and automated service provisioning. A flaw in the checkout process allows customers to bypass limits on promotional codes by submitting multiple purchase requests simultaneously. This could result in significant financial loss as users can obtain unlimited discounts or free products using codes intended for single or limited use.

Technologies: [FOSSBilling](https://junglewise.ai/threats/technologies/fossbilling). Vendors: [FOSSBilling](https://junglewise.ai/threats/vendors/fossbilling).

## Quick answers

**Is CVE-2026-43927 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-43927 being exploited in the wild.

**How severe is CVE-2026-43927?** Informational severity, with a CVSS score of 6.9, published 6 July 2026.

**Which products and versions are affected?** FOSSBilling < 0.8.0.

**Is there a fix for CVE-2026-43927?** A patch was published on 2026-08-01: Fixed in version 0.8.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-43927 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-43927?** Check whether you run FOSSBilling at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Time-of-Check Time-of-Use (TOCTOU) race condition exists in 'src/modules/Cart/Service.php'. The 'checkoutCart()' function performs a non-atomic check of the '$promo->used' counter against '$promo->maxuses' before incrementing the value. Because there is no database-level locking (e.g., SELECT FOR UPDATE) or transaction wrapping the check-and-increment sequence, an attacker can send multiple concurrent network requests that all pass the validation check before the first increment is committed. This allows for the unauthorized application of discounts beyond their intended limit. The issue is resolved in version 0.8.0.

## Affected products

- FOSSBilling FOSSBilling < 0.8.0

## Timeline

- 2026-06-04: advisory: GitHub Security Advisory published
- 2026-07-06: disclosed: CVE published to NVD
- 2026-08-01: patched: Fixed in version 0.8.0

## References

- [https://github.com/FOSSBilling/FOSSBilling/security/advisories/GHSA-w898-cx35-25gh](https://github.com/FOSSBilling/FOSSBilling/security/advisories/GHSA-w898-cx35-25gh)

## Related threats

- [FOSSBilling stored XSS in support ticket notes](https://junglewise.ai/threats/cve-2026-111048-fossbilling-is-an-open-source-billing-and-client-management)
- [FOSSBilling CSRF vulnerability in staff guest login endpoint](https://junglewise.ai/threats/cve-2026-112374-fossbilling-before-0-8-9-contains-a-cross-site-request-forgery)
- [FOSSBilling email enumeration via guest signup endpoint](https://junglewise.ai/threats/cve-2026-111056-fossbilling-is-an-open-source-billing-and-client-management)
- [FOSSBilling path traversal in template_exists endpoint](https://junglewise.ai/threats/cve-2026-111053-fossbilling-is-an-open-source-billing-and-client-management)
- [FOSSBilling authorization bypass in extension configuration management](https://junglewise.ai/threats/cve-2026-111046-fossbilling-is-an-open-source-billing-and-client-management)