CVE-2026-47741 Shopper: Race condition on Discount.usage_limit allows silent over-redemption
Attackers can exploit a race condition to exceed discount usage limits, causing financial loss for merchants via over-redemption of coupons.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-47741?
CVE-2026-47741 is a medium-severity vulnerability in shopperlabs shopper, published on 29 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, CreateOrderFromCartAction::execute previously created the Order row before checking and incrementing the discount's total_use counter. Under concurrent checkout pressure (Black Friday, flash sale, viral coupon), the global usage_limit was silently exceeded: orders were committed with the discount fully applied to price_amount while the counter blocked at usage_limit. The merchant had no signal that an over-redemption had occurred. This vulnerability is fixed in 2.8.0.
Weakness: CWE-362
Which versions are affected by CVE-2026-47741?
2 open source packages ship an affected version, including shopper/cart.
| Package | Affected | Fixed in |
|---|---|---|
shopper/cart Packagist | All versions | 2.8.0 |
shopper/cart Packagist | All versions | 2.8.0 |
How do I fix CVE-2026-47741?
Upgrade shopper/cart to 2.8.0 or later.
Is CVE-2026-47741 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-47741 exists.
Sources
Also known as GHSA-9rh9-hf3w-9fgg.