{"id":"CVE-2026-111657","kind":"vulnerability","aliases":["CVE-2026-111657"],"related":[],"title":"BeikeShop: authenticated customers can alter other customers' return shipments","description":"BeikeShop through 2.0.0.31 contains an insecure direct object reference vulnerability in the markAsShipped handler of RmaController that allows authenticated customers to modify other customers' returns. Attackers can submit sequential RMA ids to the account/rmas/{id}/mark_as_shipped endpoint to overwrite courier names and tracking numbers and mark approved returns as shipped.","summary":"BeikeShop through 2.0.0.31 lets a logged-in customer call the mark-as-shipped endpoint for return requests (RMAs) belonging to other customers by changing the id. An attacker can overwrite courier names and tracking numbers and mark approved returns as shipped.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["beikeshop","e-commerce","package","php","self-hosted"],"not_affected_if":["no-customer-accounts","returns-disabled"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-16T18:17:47+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","triaged_at":"2026-10-25T04:27:09+00:00","updated_at":"2026-10-25T04:27:09+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:27:09Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"BeikeShop: authenticated customers can alter other customers' return shipments","impact":"low","summary":"BeikeShop through 2.0.0.31 lets a logged-in customer call the mark-as-shipped endpoint for return requests (RMAs) belonging to other customers by changing the id. An attacker can overwrite courier names and tracking numbers and mark approved returns as shipped.","category":"package","nicknames":[],"who_cares":["beikeshop","php","self-hosted","e-commerce"],"confidence":0.6,"needs_auth":"yes","worst_case":"other customers' return shipping records altered, approved returns marked shipped","analyst_note":"Confirm the fixed version and whether the RmaController check is patched upstream, using the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-111657 and the BeikeShop repository.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-customer-accounts","returns-disabled"],"who_is_affected":"BeikeShop installations up to and including 2.0.0.31 that accept customer accounts and use the returns (RMA) feature are exposed. Stores without customer accounts or without returns enabled are not affected by this flaw as described.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000578,"input_tokens":3355,"output_tokens":485,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-111657':12A,15A '-2026':11A,14A '/mark_as_shipped':103C '2.0.0.31':27B,70C 'account/rmas':101C 'allow':85C 'alter':5A 'approv':64B,114C 'attack':54B,93C 'authent':2A,86C 'beikeshop':1A,16B,25B,68C 'belong':45B 'call':34B 'chang':50B 'commerc':19B 'contain':71C 'courier':57B,107C 'custom':3A,7A,33B,48B,87C,91C 'cve':10A,13A 'direct':74C 'e':18B 'e-commerc':17B 'endpoint':40B,104C 'handler':81C 'host':24B 'id':52B,98C,102C 'insecur':73C 'let':28B 'log':31B 'logged-in':30B 'mark':37B,63B,113C 'mark-as-ship':36B 'markasship':80C 'modifi':89C 'name':58B,108C 'number':61B,111C 'object':75C 'overwrit':56B,106C 'packag':20B 'php':21B 'refer':76C 'request':43B 'return':8A,42B,65B,92C,115C 'rma':97C 'rmacontrol':83C 'rmas':44B 'self':23B 'self-host':22B 'sequenti':96C 'ship':39B,67B,117C 'shipment':9A 'submit':95C 'track':60B,110C 'vulner':77C","nicknames":[],"mitigations":[],"who_affected":"BeikeShop installations up to and including 2.0.0.31 that accept customer accounts and use the returns (RMA) feature are exposed. Stores without customer accounts or without returns enabled are not affected by this flaw as described.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T18:17:47+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111657","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111657","severity":null,"published_at":"2026-10-16T18:17:47+00:00","modified_at":"2026-10-16T20:17:21+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}