Workflow enforcement flaw in BeikeShop guest order lookup
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- Low · Low · Low
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
BeikeShop versions from 2.0.0.0 before 2.0.0.32 are affected. The flaw is improper enforcement of behavioral workflow (CWE-841) in the guest order lookup, in the getOrderByNumber function, where manipulating the order_number argument triggers the workflow error. A remote attacker without privileges or user interaction can exploit it, with low impact on confidentiality, integrity and availability.
Written with Claude Haiku 5.5 from the sources below · 2026-11-09
Description from the CNA
A security flaw has been discovered in BeikeShop up to 2.0.0.31. Impacted is the function OrderRepo::getOrderByNumber of the file beike/Repositories/OrderRepo.php of the component Guest Order Lookup. Performing a manipulation of the argument order_number results in enforcement of behavioral workflow. The attack can be initiated remotely. Upgrading to version 2.0.0.32 is recommended to address this issue. The patch is named 6cf25f8c15d27d1ff14a848faf645c94d20ba5f1. It is recommended to upgrade the affected component.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | BeikeShop | 2.0.0.0; 2.0.0.1; 2.0.0.2; 2.0.0.3; 2.0.0.4; 2.0.0.5; 2.0.0.6; 2.0.0.7; 2.0.0.8; 2.0.0.9; 2.0.0.10; 2.0.0.11; 2.0.0.12; 2.0.0.13; 2.0.0.14; 2.0.0.15; 2.0.0.16; 2.0.0.17; 2.0.0.18; 2.0.0.19; 2.0.0.20; 2.0.0.21; 2.0.0.22; 2.0.0.23; 2.0.0.24; 2.0.0.25; 2.0.0.26; 2.0.0.27; 2.0.0.28; 2.0.0.29; 2.0.0.30; 2.0.0.31 | 2.0.0.32 | Patch available | CNA |
- BeikeShop Vendor— Affected 2.0.0.0; 2.0.0.1; 2.0.0.2; 2.0.0.3; 2.0.0.4; 2.0.0.5; 2.0.0.6; 2.0.0.7; 2.0.0.8; 2.0.0.9; 2.0.0.10; 2.0.0.11; 2.0.0.12; 2.0.0.13; 2.0.0.14; 2.0.0.15; 2.0.0.16; 2.0.0.17; 2.0.0.18; 2.0.0.19; 2.0.0.20; 2.0.0.21; 2.0.0.22; 2.0.0.23; 2.0.0.24; 2.0.0.25; 2.0.0.26; 2.0.0.27; 2.0.0.28; 2.0.0.29; 2.0.0.30; 2.0.0.31 Fixed in 2.0.0.32 Patch available CNA
CPE names CNA · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:beikeshop:beikeshop:*:*:*:*:*:*:*:* | — | — | Chengdu Everbrite Network Technology |
- cpe:2.3:a:beikeshop:beikeshop:*:*:*:*:*:*:*:* Versions — — ·Chengdu Everbrite Network Technology
Remediation
Upgrade BeikeShop to version 2.0.0.32, which fixes the flaw. The fix is also available as patch 6cf25f8.
Written with Claude Haiku 5.5 from the sources below · 2026-11-09
- Fix · CNA BeikeShop Fixed in 2.0.0.32
Timeline
- 2026-11-09 Threatist record created from CVE-2026-124576
References
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences