GHSA-w2cw-phpj-gcgw: 
PHP vulnerability analysis and mitigation

Commerce defines commerce-managePromotions as the parent permission for viewing promotion administration and defines commerce-editDiscounts as a nested permission for changing discounts. Most direct discount mutations correctly enforce the child permission. DiscountsController::actionClearDiscountUses(), however, checks only the broad permissions inherited from controller initialization and never requires commerce-editDiscounts. The action accepts any discount ID and resets one of three enforcement records: total usage, per-customer usage, or per-email usage. These counters are the server-side state used to enforce totalDiscountUseLimit, perUserLimit, and perEmailLimit. Resetting them makes an exhausted limited-use promotion eligible again.

Impact

A user intentionally restricted to viewing and administering the promotions area at the parent-role level can reactivate exhausted discounts without authorization. This bypasses total, per-account, and per-email redemption limits and can enable repeated use of one-time or capped coupons. Report ID: 1894