Executive brief
Shopper is a headless e-commerce admin panel. A flaw in how the system processes discounts during checkout allows customers to bypass usage limits during high-traffic events like Black Friday or flash sales. This can lead to direct financial loss for merchants as more discounts are applied than intended, with no immediate notification that the limits were exceeded.
Technical details
A race condition exists in the `CreateOrderFromCartAction::execute` method because it creates an `Order` record before checking and incrementing the discount's `total_use` counter. Under concurrent load, multiple requests can pass the initial validation and commit orders with discounts applied even after the global `usage_limit` has been reached, as the subsequent increment operation's failure is not checked. Additionally, the `usage_limit_per_user` check was non-functional because it relied on a counter that was never incremented. The vulnerability is fixed in version 2.8.0 by implementing atomic reservation with row-level locking and a compare-and-swap pattern within the database transaction.
Affected products
- Shopper Labs shopper/cart < 2.8.0
Timeline
- 2026-05-11: patched: Fixed in version 2.8.0
- 2026-05-11: advisory: GitHub Security Advisory published
- 2026-05-29: disclosed: CVE-2026-47741 published to NVD