BeikeShop RMA endpoint lets customers modify other customers' returns
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-639.
Summary
BeikeShop through 2.0.0.31 contains an insecure direct object reference in the RMA markAsShipped handler (CWE-639). An authenticated customer with low privileges can reference other customers' RMA ids to modify their returns, overwriting courier names and tracking numbers and marking approved returns as shipped.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Description from the CNA
BeikeShop through 2.0.0.31 contains an insecure direct object reference vulnerability in the markAsShipped handler of RmaController that allows authenticated customers to modify other customers' returns. Attackers can submit sequential RMA ids to the account/rmas/{id}/mark_as_shipped endpoint to overwrite courier names and tracking numbers and mark approved returns as shipped.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Chengdu Everbrite Network Technology | beikeshop | up to 2.0.0.31 | — | No fix listed | CNA |
- beikeshop VendorChengdu Everbrite Network Technology Affected up to 2.0.0.31 Fixed in — No fix listed CNA
Remediation
The sources list no fixed version for BeikeShop.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Timeline
- 2026-10-16 Threatist record created from CVE-2026-111657
- 2026-10-16 Alias added: GHSA-cqc2-r3p8-vc5x
- 2026-10-18 CISA SSVC decision points changed
- 2026-10-18 Priority changed: LOW → MEDIUM
References
More Chengdu Everbrite Network Technology vulnerabilities
- TI-2026-09891 Chengdu Everbrite Network Technology BeikeShop Stripe Plugin StripeController.php callback improper authorization CVSS 4.0MEDIUM 6.9
- TI-2026-09909 Chengdu Everbrite Network Technology BeikeShop Admin Design Builder Endpoint admin.php sql injection CVSS 4.0MEDIUM 5.3
- TI-2024-07571 Chengdu Everbrite Network Technology BeikeShop FileManagerController.php rename unrestricted upload CVSS 4.0MEDIUM 5.3
- TI-2024-07570 Chengdu Everbrite Network Technology BeikeShop files destroyFiles path traversal CVSS 4.0MEDIUM 5.3
- TI-2024-07572 Chengdu Everbrite Network Technology BeikeShop export exportZip path traversal CVSS 4.0MEDIUM 5.3
Sources
- CVE-2026-111657 · CVE Program
- CVE-2026-111657 · NVD
- FIRST EPSS
- GHSA-cqc2-r3p8-vc5x · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences