CVE-2026-111657 beikeshop CVE debrief

Who should care

Defenders responsible for BeikeShop installations, particularly those with authenticated customer sessions, should assess exposure and prioritize remediation. This includes reviewing the current version of BeikeShop, restricting access to the markAsShipped handler, and implementing proper authorization checks for RMA operations. Additionally, defenders should monitor for suspicious activity and review compensating controls for exposed systems.

Why it matters

This IDOR vulnerability in BeikeShop's RMA endpoint allows authenticated customers to modify returns of other customers, potentially leading to unauthorized changes to courier information and shipping status.

• Authenticated customers can modify returns of other customers
• Courier names and tracking numbers can be overwritten
• Approved returns can be marked as shipped without authorization
• Verification of BeikeShop version and RMA endpoint access controls is necessary

Technical summary

The BeikeShop application through version 2.0.0.31 is vulnerable to an insecure direct object reference (IDOR) vulnerability in the markAsShipped handler of RmaController. This allows authenticated customers to modify returns of other customers by submitting sequential RMA IDs to the account/rmas/{id}/mark_as_shipped endpoint. The vulnerability is caused by insufficient authorization checks, allowing attackers to overwrite courier names and tracking numbers and mark approved returns as shipped without authorization.

Defensive priority

Defenders should prioritize verifying and remediating this vulnerability in BeikeShop installations, particularly for authenticated customer sessions.

Recommended defensive actions

• Verify BeikeShop installations for version 2.0.0.31 or earlier and prioritize remediation.
• Restrict access to the markAsShipped handler of RmaController.
• Implement proper authorization checks for RMA operations.
• Monitor for suspicious activity on RMA endpoints.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and source item provide details on the insecure direct object reference vulnerability in BeikeShop's RmaController. The vulnerability allows authenticated customers to modify returns of other customers by submitting sequential RMA IDs to the mark_as_shipped endpoint.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.