beikeshop CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

MEDIUM beikeshop CVE published 2026-10-16

CVE-2026-111657

BeikeShop through 2.0.0.31 contains an insecure direct object reference vulnerability in the markAsShipped handler of RmaController. This allows authenticated customers to modify returns of other customers by submitting sequential RMA IDs to the account/rmas/{id}/mark_as_shipped endpoint, potentially leading to unauthorized changes to courier information and shipping status. The vulnerability highlights t [truncated]