Sylius exposes a Time‑of‑Check to Time‑of‑Use race condition that allows an attacker to bypass promotion and coupon usage limits. The bug arises because the eligibility check reads the usage counter from memory, while the increment occurs later, without database locking or atomic operations. Because Doctrine writes a fixed value instead of an atomic increment and the entities lack optimistic locking, concurrent order completions can pass the eligibility test multiple times, enabling unlimited redemptions of a promotion or coupon that was intended to be single‑use or customer‑limited. This failure is exploitable without authentication and can lead to direct financial loss for merchants offering discounted or promotional items. The weakness is identified as CWE‑362 and CWE‑367.

Sylius Sylius is affected. The fix is available in the following releases: 1.9.12, 1.10.16, 1.11.17, 1.12.23, 1.13.15, 1.14.18, 2.0.16, 2.1.12, 2.2.3, and all later versions.

The CVSS score of 8.2 designates high severity, though the EPSS score of <1% indicates a very low probability of automated exploitation at present. The vulnerability is not listed in CISA’s KEV catalog. Nevertheless, because authentication is not required and the attack path involves a straightforward race scenario triggered by concurrent PATCH /api/v2/shop/orders/{token}/complete requests, an attacker could programmatically generate multiple orders or craft simultaneous requests to unlock the promotion counters, achieving the undesired unlimited use. The direct financial loss potential and the lack of authentication barriers elevate the risk for e‑commerce operators using Sylius.