« Volver al listado

CVE-2026-47741

Estado: AplazadaMedia (5.9)—

Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, CreateOrderFromCartAction::execute previously created the Order row before checking and incrementing the discount's total_use counter. Under concurrent checkout pressure (Black Friday, flash sale, viral coupon), the global usage_limit was silently exceeded: orders were committed with the discount fully applied to price_amount while the counter blocked at usage_limit. The merchant had no signal that an over-redemption had occurred. This vulnerability is fixed in 2.8.0.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Shopper — ShopperAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-47741",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-47741",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-05-29T19:18:13.721164Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.9,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.2
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "shopperlabs",
          "product": "shopper",
          "versions": [
            {
              "status": "affected",
              "version": "< 2.8.0"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-05-29T19:16:25.763",
  "references": [
    {
      "url": "https://github.com/shopperlabs/shopper/issues/510",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/shopperlabs/shopper/pull/511",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/shopperlabs/shopper/security/advisories/GHSA-9rh9-hf3w-9fgg",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/shopperlabs/shopper/issues/510",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-362"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, CreateOrderFromCartAction::execute previously created the Order row before checking and incrementing the discount's total_use counter. Under concurrent checkout pressure (Black Friday, flash sale, viral coupon), the global usage_limit was silently exceeded: orders were committed with the discount fully applied to price_amount while the counter blocked at usage_limit. The merchant had no signal that an over-redemption had occurred. This vulnerability is fixed in 2.8.0."
    },
    {
      "lang": "es",
      "value": "Shopper es un Panel de Administración de e-commerce Headless. Antes de la versión 2.8.0, CreateOrderFromCartAction::execute creaba previamente la fila de la Orden antes de verificar e incrementar el contador total_use del descuento. Bajo presión de pago concurrente (Black Friday, venta flash, cupón viral), el usage_limit global se excedía silenciosamente: las órdenes se confirmaban con el descuento aplicado completamente al price_amount mientras el contador se bloqueaba en el usage_limit. El comerciante no tenía ninguna señal de que se había producido una sobre-redención. Esta vulnerabilidad está corregida en la versión 2.8.0."
    }
  ],
  "lastModified": "2026-07-22T06:10:00.170",
  "sourceIdentifier": "security-advisories@github.com"
}