Time-of-check Time-of-use (TOCTOU) Race Condition in Sylius - #VU159505
Published: November 5, 2026
Vulnerability details
The vulnerability allows unauthenticated remote attackers to bypass promotion and coupon usage limits in Sylius, redeeming limited-use discounts repeatedly and potentially causing direct financial loss. Both global promotion and coupon limits can be exceeded, including redemption of a single-use promotion or coupon multiple times. A single customer can also bypass a coupon's per-customer redemption limit by completing multiple orders concurrently.
The vulnerability exists due to a time-of-check to time-of-use race condition in order completion. Usage limits are checked only at the beginning of completion and are not checked again when usage counters are incremented. In AtomicOrderPromotionsUsageModifier, an entity is refreshed from the database and then optimistically locked using its own freshly retrieved version, so the lock cannot detect an intervening order completion. A remote attacker can prepare multiple carts using the same limited-use promotion or coupon and send PATCH requests to /api/v2/shop/orders/{token}/complete offset by a few milliseconds, allowing the requests to pass eligibility checks and complete with usage exceeding the limit. No authentication is required.
The affected limits are the global used counter on Promotion entities, the global used counter on PromotionCoupon entities, and the per-customer redemption count for PromotionCoupon entities. The optimistic lock does not detect orders completed between the initial eligibility check and the counter increment, leaving all three limits exposed to concurrent redemption.