CVE-2026-111657: BeikeShop through 2.0.0.31 IDOR via RMA mark_as_shipped Endpoint
BeikeShop through 2.0.0.31 contains an insecure direct object reference vulnerability in the markAsShipped handler of RmaController that allows authenticated customers to modify other customers' returns. Attackers can submit sequential RMA ids to the account/rmas/{id}/markasshipped endpoint to overwrite courier names and tracking numbers and mark approved returns as shipped.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
An attacker needs an authenticated customer account. No user interaction is required, and the attacker can target returns by submitting sequential RMA IDs to the affected endpoint.
Which return records can be altered?
Approved returns belonging to other customers can be modified. The attacker can overwrite the courier name and tracking number, then mark the return as shipped.
How can I check whether my deployment is affected?
Review the RMA mark-as-shipped handler for ownership validation before it updates an RMA record. Affected behavior allows one authenticated customer to submit another customer's RMA ID to account/rmas/{id}/mark_as_shipped and change its shipment details.