A critical race condition vulnerability in the Sylius eCommerce Framework allows unauthenticated attackers to bypass promotion and coupon usage limits, posing a significant risk to financial integrity.

This is a Time-of-Check to Time-of-Use race condition occurring within the promotion usage limit enforcement logic. The framework lacks atomic operations or database-level locking, enabling an unauthenticated attacker to trigger multiple successful redemptions of limited-use promotions by firing simultaneous API requests.

The ability to bypass promotion and coupon limits leads to direct financial loss and inventory depletion. An attacker can exploit this flaw to repeatedly apply discounts that are intended for single use or limited distribution, resulting in unauthorized price reductions. With a CVSS score of 8.2, this vulnerability represents a high risk to the revenue model and operational stability of any e-commerce platform using the affected framework.

Immediate Action: Upgrade to the latest patched version of Sylius (specifically 1.9.12, 1.10.16, 1.11.17, 1.12.23, or later depending on the branch) as provided by the vendor.

Proactive Monitoring: Review application and database logs for anomalous spikes in API requests, particularly those targeting promotion or checkout endpoints, which may indicate automated exploitation attempts.

Compensating Controls: While a code-level fix is necessary, Web Application Firewalls can be configured to rate-limit requests to the checkout and API endpoints to reduce the window of opportunity for concurrent request exploitation.

Public Exploit Available: No (exploit_available: false)

The severity of this vulnerability is high due to its direct impact on commercial transactions and the ease with which it can be automated. Organizations running the affected versions of the Sylius framework must prioritize the application of the vendor-supplied security patches to ensure that promotion limits are enforced correctly and to prevent financial abuse.