CVE-2026-16212
awesto django-shop Purchase Stock inventory.py race condition
- State
- Published
- Severity
- 2.3 Low
- Published
- Jul 19, 2026
- Updated
- Jul 20, 2026
- Reserved
- Jul 18, 2026
Description
A vulnerability was identified in awesto django-shop up to 1.2.4. Affected is an unknown function of the file shop/models/inventory.py of the component Purchase Stock Handler. The manipulation leads to race condition. The attack is possible to be carried out remotely. The attack is considered to have high complexity. The exploitability is told to be difficult. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 2.3 Low | CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 4.2 Medium | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 3.0 | 4.2 Medium | CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 2.0 | 3.6 Low | AV:N/AC:H/Au:S/C:N/I:P/A:P/E:POC/RL:ND/RC:UR | VulDB |
Weaknesses
- CWE-362 Race Condition
Affected Products
| Product | Versions |
|---|---|
django-shopawesto |
|
References
- VDB-380028 | awesto django-shop Purchase Stock inventory.py race conditionvdb-entry
- VDB-380028 | CTI Indicators (IOB, IOC, IOA)signaturepermissions-required
- CVE-2026-16212 | CVE Analysis and Reportthird-party-advisory
- Submit #857939 | awesto django-shop 13d9a77aff7eede74a5f363c1d540e005d88dbcd CWE-362 Concurrent Execution using Shared Resource with Improperthird-party-advisory
- https://github.com/awesto/django-shop/issues/888exploitissue-tracking
- https://github.com/awesto/django-shop/product
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.