CVE-2026-111657
MediumCVSS 4.3Summary
BeikeShop through 2.0.0.31 contains an insecure direct object reference vulnerability in the markAsShipped handler of RmaController that allows authenticated customers to modify other customers' returns. Attackers can submit sequential RMA ids to the account/rmas/{id}/mark_as_shipped endpoint to overwrite courier names and tracking numbers and mark approved returns as shipped.
Risk Assessment
An attacker could exploit this vulnerability to manipulate other customers' returns, potentially leading to logistics errors, financial losses, and customer dissatisfaction.
Recommendation
Update BeikeShop to a version later than 2.0.0.31 if available, or implement authorization checks in the markAsShipped handler to verify return ownership.
Other vulnerabilities in BeikeShop
See all- CVE-2026-11480Medium
In BeikeShop up to version 1.6.0.22, an SQL injection vulnerability was found in the file beike/Admin/Routes/admin.php within the Admin Design Builder Endpoint. Manipulating the settings.value argument allows remote attack. The exploit is publicly available.
- CVE-2026-11462High
BeikeShop up to version 1.6.0.22 has an improper authorization vulnerability in the Stripe Plugin component in StripeController.php via the Request argument. The attack can be performed remotely, and the exploit is publicly available. A patch is available at commit 6719e0fc.
Original NVD description (English source)
BeikeShop through 2.0.0.31 contains an insecure direct object reference vulnerability in the markAsShipped handler of RmaController that allows authenticated customers to modify other customers' returns. Attackers can submit sequential RMA ids to the account/rmas/{id}/mark_as_shipped endpoint to overwrite courier names and tracking numbers and mark approved returns as shipped.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS