CVE-2026-111657

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-111657
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-111657.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-111657
Published
2026-10-16T17:39:22Z
Modified
2026-10-21T02:55:12Z
Severity
  • 5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
BeikeShop through 2.0.0.31 IDOR via RMA mark_as_shipped Endpoint
Details

BeikeShop through 2.0.0.31 contains an insecure direct object reference vulnerability in the markAsShipped handler of RmaController that allows authenticated customers to modify other customers' returns. Attackers can submit sequential RMA ids to the account/rmas/{id}/mark_as_shipped endpoint to overwrite courier names and tracking numbers and mark approved returns as shipped.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-639"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111657.json"
}
References

Affected packages

Git / github.com/beikeshop/beikeshop

Affected ranges

Type
GIT
Repo
https://github.com/beikeshop/beikeshop
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last Affected
b8af606fecd753d15375937213fe01747ff6fb04
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "last_affected":  "2.0.0.31"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        }
    ]
}

Affected versions

1.*
1.5.5.6
Other
remove
v1.*
v1.0.1
v1.0.2
v1.0.3
v1.1.0
v1.1.1
v1.1.2
v1.2.0
v1.2.5
v1.2.8
v1.3.0
v1.3.2
v1.3.4
v1.3.5
v1.3.6
v1.3.7
v1.3.8
v1.4.0
v1.4.1
v1.4.2
v1.4.3
v1.5.0
v1.5.5.5
v1.5.6.6
v1.5.6.7
v1.5.6.8
v1.5.6.9
v1.6.0.10
v1.6.0.11
v1.6.0.12
v1.6.0.13
v1.6.0.14
v1.6.0.15
v1.6.0.18
v1.6.0.19
v1.6.0.22
v1.6.0.23
v1.6.0.7
v1.6.0.8
v1.6.0.9
v2.*
v2.0.0.30
v2.0.0.31

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-111657.json"