CVE-2026-109407 Details
Description
A security vulnerability has been detected in macrozheng mall up to 1.0.3. This issue affects some unknown processing of the file /order/generateOrder of the component Coupon Redemption. Such manipulation of the argument couponId leads to race condition. The attack may be performed from remote. The attack requires a high level of complexity. The exploitability is assessed as difficult. The vendor deleted the GitHub issue for this vulnerability without any explanation.
A race condition vulnerability has been identified in Macrozheng Mall versions through 1.0.3. The issue arises in the Coupon Redemption component, specifically within the order generation process. Manipulating the couponId argument in the /order/generateOrder file creates a race condition. This vulnerability can be exploited remotely, but it requires a high level of complexity, making the exploitation difficult.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 13, 2026CISA-ADP
Assessed Oct 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/macrozheng/mall/ | [email protected] | ProductSource CodeVendor |
| https://github.com/macrozheng/mall/issues/1003 | [email protected] | Broken LinkIssue TrackingVendor |
| https://vuldb.com/cve/CVE-2026-109407 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/979872 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/416949 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/416949/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-362 | Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| macrozheng mall | <= 1.0.3 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 15, 2026 | CVE Modified | CISA-ADP |
| Oct 13, 2026 | New CVE Received | [email protected] |