How to use this reference
Editorial lesson: model the limit check and entitlement consumption as one serialized decision. Accounting correctness alone does not prove eligibility correctness. In owned local models, verify that committed usage never exceeds the authorized allowance, including cancellation semantics.
Before reading
- Basic authorization, application state machines and database transaction concepts
Context and limits
- The maintainer reports limit overruns without required authentication; a limited promotion or coupon and overlapping order processing are prerequisites. Financial loss is a potential consequence, not a measured production incident.
- The advisory lists fixes in 1.9.12, 1.10.16, 1.11.17, 1.12.23, 1.13.15, 1.14.18, 2.0.16, 2.1.12 and 2.2.3. Consult its branch-specific affected ranges. Patch dates are not asserted; resource edition remains null.
- NoResponseMate published the advisory. Reporters are Djibril Mounkoro (whiteov3rflow) and Bartłomiej Nowiński (bnBart); CVE-2026-31824.
Sources and provenance
- Promotion Usage Limit Bypass via Race Condition Sylius · reviewed 2026-10-03
Record reviewed 2026-10-03. Snapshot 53796974ace8. Open the complete JSON contract.