CVE-2026-43927 Details

A race condition vulnerability has been identified in FOSSBilling, a billing and client management system, in versions through 0.7.2. The issue allows authenticated clients to misuse promo codes by applying them beyond their intended limits. This is achieved by sending multiple concurrent checkout requests before any single request can process the usage increment of the promo code. As a result, clients can exploit single-use or limited-use promo codes to receive unlimited discounts or free orders. The vulnerability arises from a lack of database-level locking and atomic operations in the checkout process, enabling the simultaneous requests to bypass usage restrictions.

Users can update to FOSSBilling version 0.8.0, which addresses this vulnerability. Alternatively, promo codes can be disabled until the update is applied, or the 'promo' table can be monitored for discrepancies in promo code usage, with affected orders reviewed manually.