{"id":"CVE-2026-124576","kind":"vulnerability","aliases":["CVE-2026-124576"],"related":[],"title":"BeikeShop: guest order lookup flaw lets remote users bypass order checks","description":"A security flaw has been discovered in BeikeShop up to 2.0.0.31. Impacted is the function OrderRepo::getOrderByNumber of the file beike/Repositories/OrderRepo.php of the component Guest Order Lookup. Performing a manipulation of the argument order_number results in enforcement of behavioral workflow. The attack can be initiated remotely. Upgrading to version 2.0.0.32 is recommended to address this issue. The patch is named 6cf25f8c15d27d1ff14a848faf645c94d20ba5f1. It is recommended to upgrade the affected component.","summary":"BeikeShop, an open-source e-commerce platform, has a flaw in its guest order lookup where manipulating the order_number argument bypasses the intended workflow enforcement. An attacker can trigger it remotely, which may expose order details belonging to other customers.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["beikeshop","e-commerce","laravel","other","php"],"not_affected_if":["version-2.0.0.32-or-later"],"how_to_check":"- Check the BeikeShop version in use; versions up to `2.0.0.31` are listed as affected.\n- Look for `OrderRepo::getOrderByNumber` in `beike/Repositories/OrderRepo.php`, which is the affected function.","fix":"- BeikeShop: upgrade to `2.0.0.32`, as recommended in the NVD description.","status":"open","published_at":"2026-11-09T07:17:32+00:00","first_seen_at":"2026-11-09T07:25:05+00:00","triaged_at":"2026-11-09T07:25:24+00:00","updated_at":"2026-11-09T07:25:24+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-09T07:25:24Z","model":"claude-haiku-5-5","output":{"fix":"- BeikeShop: upgrade to `2.0.0.32`, as recommended in the NVD description.","reach":"internet","title":"BeikeShop: guest order lookup flaw lets remote users bypass order checks","impact":"medium","summary":"BeikeShop, an open-source e-commerce platform, has a flaw in its guest order lookup where manipulating the order_number argument bypasses the intended workflow enforcement. An attacker can trigger it remotely, which may expose order details belonging to other customers.","audience":"businesses","category":"other","nicknames":[],"who_cares":["beikeshop","e-commerce","php","laravel"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"remote users read or alter other customers' order data","analyst_note":"","how_to_check":"- Check the BeikeShop version in use; versions up to `2.0.0.31` are listed as affected.\n- Look for `OrderRepo::getOrderByNumber` in `beike/Repositories/OrderRepo.php`, which is the affected function.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["version-2.0.0.32-or-later"],"who_is_affected":"Stores running BeikeShop up to version 2.0.0.31 that expose the guest order lookup feature to the internet are exposed. The flaw sits in the guest order lookup component, so stores that disable guest lookup or run only logged-in customer accounts may not be reachable this way, but the sources do not confirm this.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000747,"input_tokens":4685,"output_tokens":557,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-124576':14A,17A '-2026':13A,16A '2.0.0.31':78C '2.0.0.32':118C '6cf25f8c15d27d1ff14a848faf645c94d20ba5f1':129C 'address':122C 'affect':136C 'argument':47B,100C 'attack':54B,110C 'behavior':107C 'beike/repositories/orderrepo.php':88C 'beikeshop':1A,18B,25B,75C 'belong':64B 'bypass':9A,48B 'check':11A 'commerc':21B,32B 'compon':91C,137C 'custom':67B 'cve':12A,15A 'detail':63B 'discov':73C 'e':20B,31B 'e-commerc':19B,30B 'enforc':52B,105C 'expos':61B 'file':87C 'flaw':5A,36B,70C 'function':82C 'getorderbynumb':84C 'guest':2A,39B,92C 'impact':79C 'initi':113C 'intend':50B 'issu':124C 'laravel':22B 'let':6A 'lookup':4A,41B,94C 'manipul':43B,97C 'may':60B 'name':128C 'number':46B,102C 'open':28B 'open-sourc':27B 'order':3A,10A,40B,45B,62B,93C,101C 'orderrepo':83C 'patch':126C 'perform':95C 'php':24B 'platform':33B 'recommend':120C,132C 'remot':7A,58B,114C 'result':103C 'secur':69C 'sourc':29B 'trigger':56B 'upgrad':115C,134C 'user':8A 'version':117C 'workflow':51B,108C","nicknames":[],"mitigations":[],"who_affected":"Stores running BeikeShop up to version 2.0.0.31 that expose the guest order lookup feature to the internet are exposed. The flaw sits in the guest order lookup component, so stores that disable guest lookup or run only logged-in customer accounts may not be reachable this way, but the sources do not confirm this.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["beikeshop","ecommerce","high","laravel","other","php"],"campaign_type":null,"search_a":"'-124576':14A,17A '-2026':13A,16A 'beikeshop':1A 'bypass':9A 'check':11A 'cve':12A,15A 'flaw':5A 'guest':2A 'let':6A 'lookup':4A 'order':3A,10A 'remot':7A 'user':8A","search_b":"'argument':47B 'attack':54B 'beikeshop':18B,25B 'belong':64B 'bypass':48B 'commerc':21B,32B 'custom':67B 'detail':63B 'e':20B,31B 'e-commerc':19B,30B 'enforc':52B 'expos':61B 'flaw':36B 'guest':39B 'intend':50B 'laravel':22B 'lookup':41B 'manipul':43B 'may':60B 'number':46B 'open':28B 'open-sourc':27B 'order':40B,45B,62B 'php':24B 'platform':33B 'remot':58B 'sourc':29B 'trigger':56B 'workflow':51B","search_c":"'2.0.0.31':78C '2.0.0.32':118C '6cf25f8c15d27d1ff14a848faf645c94d20ba5f1':129C 'address':122C 'affect':136C 'argument':100C 'attack':110C 'behavior':107C 'beike/repositories/orderrepo.php':88C 'beikeshop':75C 'compon':91C,137C 'discov':73C 'enforc':105C 'file':87C 'flaw':70C 'function':82C 'getorderbynumb':84C 'guest':92C 'impact':79C 'initi':113C 'issu':124C 'lookup':94C 'manipul':97C 'name':128C 'number':102C 'order':93C,101C 'orderrepo':83C 'patch':126C 'perform':95C 'recommend':120C,132C 'remot':114C 'result':103C 'secur':69C 'upgrad':115C,134C 'version':117C 'workflow':108C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T07:17:32+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124576","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124576","severity":null,"published_at":"2026-11-09T07:17:32+00:00","modified_at":"2026-11-09T07:17:32+00:00","first_seen_at":"2026-11-09T07:25:05+00:00","fetched_at":"2026-11-09T07:25:05+00:00","note":null}],"documents":[{"id":106287,"url":"https://github.com/beikeshop/beikeshop/commit/6cf25f8c15d27d1ff14a848faf645c94d20ba5f1","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":106288,"url":"https://github.com/beikeshop/beikeshop/releases/tag/v2.0.0.32","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":106289,"url":"https://github.com/beikeshop/beikeshop/security/advisories/GHSA-p2x8-f9cm-m352","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}