CVE-2026-111657

BeikeShop through 2.0.0.31 contains an insecure direct object reference vulnerability in the markAsShipped handler of RmaController that allows authenticated customers to modify other customers' returns. Attackers can submit sequential RMA ids to the account/rmas/{id}/mark_as_shipped endpoint to overwrite courier names and tracking numbers and mark approved returns as shipped.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/beikeshop/beikeshop/blob/v2.0.0.31/beike/Shop/Http/Controllers/Account/RmaController.php#L67-L93
https://github.com/beikeshop/beikeshop/blob/v2.0.0.31/beike/Shop/Routes/shop.php#L98-L111
https://hackmd.io/@hieuPenguinnn/beikeshop-rma-mark-as-shipped-missing-ownership-idor
https://www.vulncheck.com/advisories/beikeshop-through-2.0.0.31-idor-via-rma-mark-as-shipped-endpoint
https://hackmd.io/@hieuPenguinnn/beikeshop-rma-mark-as-shipped-missing-ownership-idor

Configurations

No configuration.

History

16 Oct 2026, 20:17

Type	Values Removed	Values Added
References	~~() https://hackmd.io/@hieuPenguinnn/beikeshop-rma-mark-as-shipped-missing-ownership-idor -~~	() https://hackmd.io/@hieuPenguinnn/beikeshop-rma-mark-as-shipped-missing-ownership-idor -

16 Oct 2026, 18:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-10-16 18:17

Updated : 2026-10-16 20:17

NVD link : CVE-2026-111657

Mitre link : CVE-2026-111657

CVE.ORG link : CVE-2026-111657

JSON object : View

Products Affected

No product.

CWE

CWE-639

Authorization Bypass Through User-Controlled Key

{"id": "CVE-2026-111657", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-111657", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-16T19:15:18.906747Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"repo": "https://github.com/beikeshop/beikeshop", "vendor": "beikeshop", "product": "beikeshop", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "2.0.0.31"}], "packageURL": "pkg:github/beikeshop/beikeshop", "defaultStatus": "unaffected"}]}], "published": "2026-10-16T18:17:47.083", "references": [{"url": "https://github.com/beikeshop/beikeshop/blob/v2.0.0.31/beike/Shop/Http/Controllers/Account/RmaController.php#L67-L93", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/beikeshop/beikeshop/blob/v2.0.0.31/beike/Shop/Routes/shop.php#L98-L111", "source": "disclosure@vulncheck.com"}, {"url": "https://hackmd.io/@hieuPenguinnn/beikeshop-rma-mark-as-shipped-missing-ownership-idor", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/beikeshop-through-2.0.0.31-idor-via-rma-mark-as-shipped-endpoint", "source": "disclosure@vulncheck.com"}, {"url": "https://hackmd.io/@hieuPenguinnn/beikeshop-rma-mark-as-shipped-missing-ownership-idor", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-639"}]}], "descriptions": [{"lang": "en", "value": "BeikeShop through 2.0.0.31 contains an insecure direct object reference vulnerability in the markAsShipped handler of RmaController that allows authenticated customers to modify other customers' returns. Attackers can submit sequential RMA ids to the account/rmas/{id}/mark_as_shipped endpoint to overwrite courier names and tracking numbers and mark approved returns as shipped."}], "lastModified": "2026-10-16T20:17:21.773", "sourceIdentifier": "disclosure@vulncheck.com"}