CVE-2026-124576 · Other
NO FIX YET · SEE WHAT TO DO
BeikeShop, an open-source e-commerce platform, has a flaw in its guest order lookup where manipulating the order_number argument bypasses the intended workflow enforcement. An attacker can trigger it remotely, which may expose order details belonging to other customers.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Stores running BeikeShop up to version 2.0.0.31 that expose the guest order lookup feature to the internet are exposed. The flaw sits in the guest order lookup component, so stores that disable guest lookup or run only logged-in customer accounts may not be reachable this way, but the sources do not confirm this.
Not affected if version-2.0.0.32-or-later
Who cares beikeshop, e-commerce, laravel, php
2.0.0.31 are listed as affected.OrderRepo::getOrderByNumber in beike/Repositories/OrderRepo.php, which is the affected function.2.0.0.32, as recommended in the NVD description.A security flaw has been discovered in BeikeShop up to 2.0.0.31. Impacted is the function OrderRepo::getOrderByNumber of the file beike/Repositories/OrderRepo.php of the component Guest Order Lookup. Performing a manipulation of the argument order_number results in enforcement of behavioral workflow. The attack can be initiated remotely. Upgrading to version 2.0.0.32 is recommended to address this issue. The patch is named 6cf25f8c15d27d1ff14a848faf645c94d20ba5f1. It is recommended to upgrade the affected component.
This page as .md ·
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.