Authenticated Customer Coupon Bypass in Thelia

Executive Summary

Thelia versions before 3.1.5 and 3.2.x before 3.2.4 have a business logic flaw where authenticated customers can bypass coupon usage limits. The system only counts coupon usage when orders become paid, allowing attackers to place multiple pay-later orders without depleting the coupon's max_usage limit. They can also cancel paid orders to artificially inflate the max_usage value, effectively gaining unlimited discounts.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check Thelia versions for 3.1.5/3.2.4 or earlier. Review coupon usage logs for multiple unpaid orders using the same coupon or frequent cancellations inflating usage counts. Inspect database tables like order_coupon and coupon for inconsistent usage values. Monitor for unusually high discount redemptions or coupon code abuse patterns.

Useful 0 Not Useful 0

Impact Analysis

If you use Thelia for e-commerce, attackers could exploit this to obtain unlimited discounts, causing financial losses. Merchants may face revenue reduction, while legitimate customers could be disadvantaged by unfair discount hoarding. The vulnerability requires authenticated access, so attackers must first gain customer-level access to the system.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized discounts and financial losses, which may violate data protection principles under GDPR (e.g., integrity and confidentiality of processing) and HIPAA (e.g., financial integrity of transactions). Improper coupon enforcement may also conflict with internal compliance controls requiring accurate financial tracking.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Thelia to version 3.1.5 or later if using 3.x branch, or 3.2.4 or later if using 3.2.x branch to fix the business logic flaw. Review coupon usage limits and order status checks to ensure proper enforcement of limits regardless of payment status.

Useful 0 Not Useful 0