Threats affecting pkg:github/beikeshop/beikeshop

BeikeShop versions through 2.0.0.31 have an insecure direct object reference (IDOR) vulnerability in the markAsShipped handler of the RmaController. Authenticated customers can exploit this flaw by submitting sequential RMA IDs to the account/rmas/{id}/mark_as_shipped endpoint, allowing them to modify other customers' return shipments. This includes overwriting courier names, tracking numbers, and marking approved returns as shipped without authorization.

CVE-2026-11480 is a SQL injection vulnerability in Chengdu Everbrite Network Technology's BeikeShop product up to version 1.6.0.22. The issue exists in the Admin Design Builder Endpoint, specifically in the beike/Admin/Routes/admin.php file, where manipulation of the argument settings.value can lead to SQL injection. The vulnerability can be exploited remotely without user interaction. A patch has been identified but no official remediation level or patch availability is confirmed in the advisory.