BeikeShop through 2.0.0.31 contains an insecure direct object reference vulnerability in the markAsShipped handler of RmaController that allows… (CVE-2026-111657)

CVE-2026-111657 describes an insecure direct object reference vulnerability in BeikeShop through version 2.0.0.31. The vulnerability exists in the markAsShipped handler of the RmaController, where authenticated users can manipulate the endpoint account/rmas/{id}/mark_as_shipped by submitting sequential RMA IDs. This allows unauthorized modification of other customers' return information, specifically courier details and shipment status. The vulnerability requires authenticated access and does not impact confidentiality or availability but allows limited integrity modification.

The vulnerability allows authenticated users to alter return shipment data of other customers, including courier names and tracking numbers, and mark returns as shipped. This can lead to data integrity issues in the returns process, potentially causing confusion or fraud in return handling. There is no impact on confidentiality or availability according to the CVSS vector. No known exploits are reported in the wild.

No patch or official fix information is currently available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, restrict access to the affected endpoint to trusted users only and monitor for suspicious activity involving RMA modifications.