BeikeShop CVE-2026-124576

Exploitation targets the Guest Order Lookup path for orders placed as a guest (customer_id is null); the pre-patch OrderRepo::getOrderByNumber returned such orders by order_number without verifying that the requester owns the order via session data or the api/* Bksessionid header. The CVSS vector is AV:N/AC:L/AT:N/PR:N/UI:N, so exploitation is remote and does not require authentication or user interaction. Limiting factors: the target store must actually use guest checkout so guest orders exist, and the attacker must reach valid/guessable order_number values; the related PayPal create/capture abuse surface additionally requires the PayPal plugin to be active (the fix wraps that path in getPayableOrder with a checkActive('paypal') gate). Customer-owned orders are not affected by this specific guest-authorization gap.

This is a broken-access-control / insecure-direct-object-reference flaw in BeikeShop's Guest Order Lookup (OrderRepo::getOrderByNumber), classified CWE-841. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes remote, low-complexity, unauthenticated reachability, which is consistent with the patch: before the fix, a guest order could be retrieved by its order_number with no ownership/session check, and the commit introduces isGuestOrderAuthorized() to bind a guest order to a session or Bksessionid header. Impact is rated Low across the board (VC:L/VI:L/VA:L), yielding a Medium score of 6.9 - this is an exposure-of-order-data and limited order/payment-workflow abuse issue, not remote code execution. There is NO EPSS score, NO CISA KEV listing, and NO confirmed public exploit in the input, so there is no signal of active or widespread exploitation; the only priority signal is the vendor/VulDB 'this_month' decision label and the availability of a patch. The affected product (an open-source Laravel e-commerce platform) has a modest deployment footprint, further lowering real-world urgency. Net assessment: a legitimate Medium-severity access-control bug worth patching on a normal cycle, not a high-CVSS emergency; the only partial conflict is that the CWE label (behavioral-workflow enforcement) is vaguer than the code, which clearly shows missing guest-order authorization.

A remote, unauthenticated attacker queries the guest order lookup with manipulated order_number values and, because the pre-patch getOrderByNumber performs no session/ownership binding for guest orders, retrieves order records belonging to other guests. In deployments using the PayPal plugin, the same unauthorized order access could be leveraged to reach payment create/capture handling for another guest's unpaid order. No public exploit code is identified in the provided sources.