BeikeShop RMA endpoint lets customers modify other customers' returns
BeikeShop through 2.0.0.31 contains an insecure direct object reference vulnerability in the markAsShipped handler of RmaController that allows authenticated customers to modify other customers' returns.