EUVD-2026-103079
GHSA-cqc2-r3p8-vc5x
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privilege customer
-
ExploitEnumerate sequential RMA ids
-
ExecutionSubmit mark_as_shipped requests to account/rmas/{id}
-
ImpactOverwrite courier/tracking and mark returns shipped
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Object-level authorization, IDOR prevention
|
| Exploitation Conditions | Requires a valid authenticated customer account on the target BeikeShop store (PR:L) and network access to the storefront; no special feature or non-default configuration is needed because the flaw is a missing ownership check in the markAsShipped handler itself. Exploitation is further enabled by predictable sequential RMA ids, allowing enumeration. Limiting factors: the attacker must hold a legitimate authenticated session, and the targeted RMAs must exist and be in an approved state for the mark-as-shipped action to apply; impact is restricted to tampering with return shipping metadata (courier, tracking, shipped flag), with no data disclosure or service disruption. |
| Impact | This is a medium-severity authorization flaw (vendor CVSS 4.0 base 5.3) whose real-world risk is moderate-to-low. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) indicates a network-reachable, low-complexity attack with no user interaction, but it requires an authenticated low-privilege account (PR:L), and impact is confined to low integrity (VI:L) with no confidentiality (VC:N) and no availability (VA:N) effect - the attacker can only tamper with other customers' RMA/return shipping records (courier names, tracking numbers, shipped status), not read data or disrupt the service. No EPSS score, KEV listing, or SSVC decision data was provided, and there is no explicit POC flag, so exploitation probability cannot be quantified from the input; this reads as a real but low-urgency hardening issue rather than an emergency. One conflict to flag: the input tag 'Authentication Bypass' contradicts the CWE-639 (IDOR) classification and the description - this is an authorization/ownership-check failure that REQUIRES authentication, not an authentication bypass, so that tag should not drive triage. |
| Exploit ScenarioDerived | A registered BeikeShop customer logs into their own account, then iterates sequential RMA ids against the account/rmas/{id}/mark_as_shipped endpoint. Because the markAsShipped handler omits an ownership check, they overwrite other customers' courier names and tracking numbers and flip approved returns to 'shipped'. A detailed public technical writeup describing the flaw exists (hackmd), but no weaponized exploit code is flagged in the available data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 16, 2026
BeikeShop through 2.0.0.31 contains an insecure direct object reference (IDOR) in the markAsShipped handler of RmaController that allows authenticated customers to modify other customers' return shipping details. By submitting sequential RMA IDs to the account/rmas/{id}/mark_as_shipped endpoint, an attacker with a valid customer account can overwrite courier names and tracking numbers and mark approved returns as shipped. The vendor CVSS 4.0 base score is 5.3 (PR:L, VI:L), matching an independent assessment of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N; no public exploit code has been identified at the time of analysis, though a technical write-up is available.
RemediationAI
No vendor-released patch has been identified at the time of analysis; the affected version is through 2.0.0.31, and no fixed version is listed in the provided data. The primary fix is to add an ownership check in RmaController::markAsShipped that verifies the authenticated customer owns the RMA record before allowing the shipping update, and to upgrade to a version beyond 2.0.0.31 if the vendor releases one. As compensating controls, restrict access to the account/rmas/{id}/mark_as_shipped endpoint using a web application firewall rule or custom middleware that validates RMA ownership server-side, or replace sequential RMA IDs with unpredictable UUIDs to hinder enumeration; however, these workarounds do not fully eliminate the authorization flaw and may affect legitimate functionality. Refer to the VulnCheck advisory at https://www.vulncheck.com/advisories/beikeshop-through-2.0.0.31-idor-via-rma-mark-as-shipped-endpoint and the source references for further details.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a CWE-639 authorization bypass through user-controlled key, a class of IDOR where an application uses a client-supplied identifier to access an object without verifying that the requester owns it. In BeikeShop, the RmaController::markAsShipped action (see GitHub source lines 67-93 of beike/Shop/Http/Controllers/Account/RmaController.php at tag v2.0.0.31) fails to check that the authenticated customer owns the RMA record before updating its shipping fields. The route is defined in beike/Shop/Routes/shop.php (lines 98-111) as account/rmas/{id}/mark_as_shipped, and the {id} parameter is a sequential integer, making enumeration trivial. The CPE cpe:2.3:a:beikeshop:beikeshop:*:*:*:*:*:*:*:* covers all versions through 2.0.0.31. Exploitation requires a valid authenticated customer session (CVSS vector PR:L) and only affects the integrity of return shipping metadata; there is no confidentiality or availability impact, matching the assessed vector.
Know when Beikeshop gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Network-reachable endpoint with low complexity but requires an authenticated customer account (PR:L); only low integrity impact from tampering with RMA records, with no confidentiality or availability effect.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
BeikeShop through 2.0.0.31 contains an insecure direct object reference vulnerability in the markAsShipped handler of RmaController that allows authenticated customers to modify other customers' returns. Attackers can submit sequential RMA ids to the account/rmas/{id}/mark_as_shipped endpoint to overwrite courier names and tracking numbers and mark approved returns as shipped.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Improper authorization in the BeikeShop e-commerce platform (versions up to 1.6.0.22) allows remote unauthenticated atta
A vulnerability was found in Chengdu Everbrite Network Technology BeikeShop up to 1.5.5. Rated low severity (CVSS 2.1),
A vulnerability was determined in Chengdu Everbrite Network Technology BeikeShop up to 1.5.5. Rated low severity (CVSS 2
A vulnerability was identified in Chengdu Everbrite Network Technology BeikeShop up to 1.5.5. Rated low severity (CVSS 2
Exploit-DB