Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:LSummary
CVE-2026-31824 is a high-severity Race Condition (CWE-362) vulnerability in Sylius Sylius. Its CVSS base score is 8.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Path Interception (T1034); ranked at the 8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-25 (Reference Monitor) and AC-3 (Access Enforcement) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-31824 is a Time-of-Check to Time-of-Use (TOCTOU) race condition vulnerability in the promotion usage limit enforcement of Sylius, an open-source eCommerce framework built on Symfony. The issue affects the global used counter on Promotion entities, the global used counter on PromotionCoupon entities, and the per-customer redemption count on PromotionCoupon entities. During validation, eligibility checks read usage counters from in-memory Doctrine entities, but the actual increment occurs later in the OrderPromotionsUsageModifier during order completion, without database-level locking or atomic operations. Doctrine flushes absolute values rather than atomic increments, and the entities lack optimistic locking, allowing concurrent requests to read stale counts and bypass limits.
The vulnerability can be exploited by unauthenticated attackers who prepare multiple carts using the same limited-use promotion or coupon and simultaneously send PATCH requests to /api/v2/shop/orders/{token}/complete. All requests pass the eligibility checks and complete successfully, enabling arbitrary redemptions of single-use promotions or coupons. A single customer can similarly bypass per-customer limits by completing multiple orders concurrently. Successful exploitation leads to direct financial loss for merchants through unlimited discount redemptions. The CVSS v3.1 base score is 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L), linked to CWEs 362 (Concurrent Execution using Shared Resource with Improper Synchronization) and 367 (TOCTOU Race Condition).
The GitHub Security Advisory (GHSA-7mp4-25j8-hp5q) confirms the fix in Sylius versions 1.9.12, 1.10.16, 1.11.17, 1.12.23, 1.13.15, 1.14.18, 2.0.16, 2.1.12, 2.2.3, and above. Security practitioners should upgrade affected deployments immediately and review concurrent order processing in eCommerce APIs for similar race conditions.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-10920
Vulnerability Data
Sylius is an Open Source eCommerce Framework on Symfony. A Time-of-Check To Time-of-Use (TOCTOU) race condition was discovered in the promotion usage limit enforcement. The same class of vulnerability affects the promotion usage limit (the global used counter on Promotion…
more
entities), coupon usage limit (the global used counter on PromotionCoupon entities), and coupon per-customer usage limit (the per-customer redemption count on PromotionCoupon entities). In all three cases, the eligibility check reads the used counter (or order count) from an in-memory Doctrine entity during validation, while the actual usage increment in OrderPromotionsUsageModifier happens later during order completion — with no database-level locking or atomic operations between the two phases. Because Doctrine flushes an absolute value (SET used = 1) rather than an atomic increment (SET used = used + 1), and because the affected entities lack optimistic locking, concurrent requests all read the same stale usage counts and pass the eligibility checks simultaneously. An attacker can exploit this by preparing multiple carts with the same limited-use promotion or coupon and firing simultaneous PATCH /api/v2/shop/orders/{token}/complete requests. All requests pass the usage limit checks and complete successfully, allowing a single-use promotion or coupon to be redeemed an arbitrary number of times. The per-customer limit can be bypassed in the same way by a single customer completing multiple orders concurrently. No authentication is required to exploit this vulnerability. This may lead to direct financial loss through unlimited redemption of limited-use promotions and discount coupons. The issue is fixed in versions: 1.9.12, 1.10.16, 1.11.17, 1.12.23, 1.13.15, 1.14.18, 2.0.16, 2.1.12, 2.2.3 and above.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V10.4.2V10.4.5V15.1.3V15.4.1
Mitigating Controls (NIST 800-53 r5) AI
A reference monitor that is always invoked and analyzable structurally eliminates the non-atomic check-then-use pattern underlying TOCTOU.
Access enforcement that performs an atomic check-and-use decision directly stops the window in which a TOCTOU race can be exploited.
Maintaining separate execution domains for each process structurally eliminates unintended concurrent access to the same shared resources.
Preventing unintended information transfer through shared system resources directly addresses the improper concurrent modification that defines a race condition.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require proper synchronization primitives and concurrency testing that prevent race conditions.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect race conditions, but does not prevent them at design or coding time.
Secure SDLC mandates concurrency controls and synchronization primitives that directly prevent race conditions.
Application security requirements can specify thread-safety and locking rules, but do not prescribe implementation details.
Secure architecture principles require proper synchronization and resource isolation, addressing the root cause of CWE-362.
Secure coding standards explicitly forbid unsafe concurrent access patterns and mandate atomic operations or locks.
Reliable, synchronized time across systems narrows the exploitable window in which a resource state can change between a security check and its use.