CVE-2026-111657

The BeikeShop software (through version 2.0.0.31 ) is vulnerable to an Insecure Direct Object Reference (IDOR) in the markAsShipped handler of the RmaController . This flaw allows authenticated customers to modify returns belonging to other customers by submitting sequential RMA IDs to the accoun...

CVE-2026-111657 BeikeShop through 2.0.0.31 IDOR via RMA mark_as_shipped Endpoint

BeikeShop through 2.0.0.31 contains an insecure direct object reference vulnerability in the markAsShipped handler of RmaController that allows authenticated customers to modify other customers' returns. Attackers can submit sequential RMA ids to the account/rmas/id/markasshipped endpoint to...