CVE-2026-109407: Race Condition in macrozheng mall

This vulnerability affects macrozheng mall up to version 1.0.3 in the Coupon Redemption component at the /order/generateOrder endpoint. The flaw arises from a race condition triggered by manipulating the couponId argument. The attack can be performed remotely but requires a high level of complexity, making exploitation difficult. The vendor has not provided a patch or advisory and deleted the related GitHub issue without explanation. The CVSS 4.0 base score is 2.3, indicating low severity.

The vulnerability could allow an attacker to exploit a race condition in coupon redemption processing remotely, potentially leading to unintended behavior in order generation. However, due to the high complexity and difficult exploitability, the practical impact is limited. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or advisory is available and the vendor removed the GitHub issue, users should monitor for updates from the vendor or community. Until a patch is released, cautious handling of coupon redemption and limiting exposure of the affected endpoint may reduce risk.