---
id: "CVE-2026-124576"
page: "https://infrastack.ai/live/CVE-2026-124576"
kind: "vulnerability"
aliases: ["CVE-2026-124576"]
title: "BeikeShop: guest order lookup flaw lets remote users bypass order checks"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["beikeshop", "e-commerce", "laravel", "other", "php"]
not_affected_if: ["version-2.0.0.32-or-later"]
published_at: "2026-11-09T07:17:32+00:00"
first_seen_at: "2026-11-09T07:25:05+00:00"
updated_at: "2026-11-09T07:25:24+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124576", "first_seen_at": "2026-11-09T07:25:05+00:00"}]
exploit_sources: []
---

# BeikeShop: guest order lookup flaw lets remote users bypass order checks

Link for people: https://infrastack.ai/live/CVE-2026-124576 (this .md is for agents)

BeikeShop, an open-source e-commerce platform, has a flaw in its guest order lookup where manipulating the order_number argument bypasses the intended workflow enforcement. An attacker can trigger it remotely, which may expose order details belonging to other customers.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the BeikeShop version in use; versions up to `2.0.0.31` are listed as affected.
- Look for `OrderRepo::getOrderByNumber` in `beike/Repositories/OrderRepo.php`, which is the affected function.

## Fix

- BeikeShop: upgrade to `2.0.0.32`, as recommended in the NVD description.

## Timeline

- 2026-11-09T07:25:05+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124576

## Documents

- [advisory] Vendor advisory: github.com https://github.com/beikeshop/beikeshop/security/advisories/GHSA-p2x8-f9cm-m352
- [fix] Patch: github.com https://github.com/beikeshop/beikeshop/commit/6cf25f8c15d27d1ff14a848faf645c94d20ba5f1
- [fix] Release notes: github.com https://github.com/beikeshop/beikeshop/releases/tag/v2.0.0.32

## From the sources

A security flaw has been discovered in BeikeShop up to 2.0.0.31. Impacted is the function OrderRepo::getOrderByNumber of the file beike/Repositories/OrderRepo.php of the component Guest Order Lookup. Performing a manipulation of the argument order_number results in enforcement of behavioral workflow. The attack can be initiated remotely. Upgrading to version 2.0.0.32 is recommended to address this issue. The patch is named 6cf25f8c15d27d1ff14a848faf645c94d20ba5f1. It is recommended to upgrade the affected component.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_