CVE-2026-109407

EUVD-2026-98552

13.10.2026, 13:17

A security vulnerability has been detected in macrozheng mall up to 1.0.3. This issue affects some unknown processing of the file /order/generateOrder of the component Coupon Redemption. Such manipulation of the argument couponId leads to race condition. The attack may be performed from remote. The attack requires a high level of complexity. The exploitability is assessed as difficult. The vendor deleted the GitHub issue for this vulnerability without any explanation.

Race Condition

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
VulDB	CNA	3.1 LOW	NETWORK	HIGH	LOW	CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

Base Score

CVSS 3.x

EPSS Score

Percentile: 15.73%

Early Detection

Affected products identified ahead of NVD analysis through intelligence sources.

Vendor	Product	Version	Source
macrozheng	mall	1.0.0	CNA
macrozheng	mall	1.0.1	CNA
macrozheng	mall	1.0.2	CNA
macrozheng	mall	1.0.3	CNA

Common Weakness Enumeration

CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
The program contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently.

References

https://github.com/macrozheng/mall/

https://github.com/macrozheng/mall/issues/1003

https://vuldb.com/cve/CVE-2026-109407

https://vuldb.com/submit/979872

https://vuldb.com/vuln/416949

https://vuldb.com/vuln/416949/cti