---
id: "CVE-2026-111657"
kind: "vulnerability"
aliases: ["CVE-2026-111657"]
title: "BeikeShop: authenticated customers can alter other customers' return shipments"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["beikeshop", "e-commerce", "package", "php", "self-hosted"]
not_affected_if: ["no-customer-accounts", "returns-disabled"]
published_at: "2026-10-16T18:17:47+00:00"
first_seen_at: "2026-10-23T21:57:13+00:00"
updated_at: "2026-10-25T04:27:09+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111657", "first_seen_at": "2026-10-23T21:57:13+00:00"}]
---

# BeikeShop: authenticated customers can alter other customers' return shipments

BeikeShop through 2.0.0.31 lets a logged-in customer call the mark-as-shipped endpoint for return requests (RMAs) belonging to other customers by changing the id. An attacker can overwrite courier names and tracking numbers and mark approved returns as shipped.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-10-23T21:57:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111657

## From the sources

BeikeShop through 2.0.0.31 contains an insecure direct object reference vulnerability in the markAsShipped handler of RmaController that allows authenticated customers to modify other customers' returns. Attackers can submit sequential RMA ids to the account/rmas/{id}/mark_as_shipped endpoint to overwrite courier names and tracking numbers and mark approved returns as shipped.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_