Language: Go
Label: vulnerable
CWE: CWE-366 \u2014 Race Condition within a Thread
If two threads of execution use a resource simultaneously, there exists the possibility that resources may be used while invalid, in turn making the state of execution undefined.

Code:
func (ur *UserRankRepo) TriggerUserRank(ctx context.Context,
	session *xorm.Session, userID string, deltaRank int, activityType int,
) (isReachStandard bool, err error) {
	// IMPORTANT: If user center enabled the rank agent, then we should not change user rank.
	if plugin.RankAgentEnabled() {
		return false, nil
	}
	if deltaRank == 0 {
		return false, nil
	}

	if deltaRank < 0 {
		// if user rank is lower than 1 after this action, then user rank will be set to 1 only.
		var isReachMin bool
		isReachMin, err = ur.checkUserMinRank(ctx, session, userID, deltaRank)
		if err != nil {
			return false, errors.InternalServer(reason.DatabaseError).WithError(err).WithStack()
		}
		if isReachMin {
			_, err = session.Where(builder.Eq{"id": userID}).Update(&entity.User{Rank: 1})
			if err != nil {
				return false, errors.InternalServer(reason.DatabaseError).WithError(err).WithStack()
			}
			return true, nil
		}
	} else {
		isReachStandard, err = ur.checkUserTodayRank(ctx, session, userID, activityType)
		if err != nil {
			return false, errors.InternalServer(reason.DatabaseError).WithError(err).WithStack()
		}
		if isReachStandard {
			return isReachStandard, nil
		}
	}
	_, err = session.Where(builder.Eq{"id": userID}).Incr("`rank`", deltaRank).Update(&entity.User{})
	if err != nil {
		return false, errors.InternalServer(reason.DatabaseError).WithError(err).WithStack()
	}
	return false, nil
}