---
id: CVE-2026-111657
title: BeikeShop through 2.0.0.31 IDOR via RMA mark_as_shipped Endpoint
summary: >-
  BeikeShop through 2.0.0.31 contains an insecure direct object reference
  vulnerability in the markAsShipped handler of RmaController that allows
  authenticated customers to modify other customers' returns. Attackers can
  submit sequential R…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-639
vendor: beikeshop
product: beikeshop
affected:
  - beikeshop <= 2.0.0.31
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-16T19:15:18.906747Z'
exploitAvailable: true
published: '2026-10-16'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T19:15:51.541Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-111657'
references:
  - url: >-
      https://hackmd.io/@hieuPenguinnn/beikeshop-rma-mark-as-shipped-missing-ownership-idor
  - url: >-
      https://github.com/beikeshop/beikeshop/blob/v2.0.0.31/beike/Shop/Http/Controllers/Account/RmaController.php#L67-L93
  - url: >-
      https://github.com/beikeshop/beikeshop/blob/v2.0.0.31/beike/Shop/Routes/shop.php#L98-L111
  - url: >-
      https://www.vulncheck.com/advisories/beikeshop-through-2.0.0.31-idor-via-rma-mark-as-shipped-endpoint
    label: >-
      VulnCheck Advisory: BeikeShop through 2.0.0.31 IDOR via RMA
      mark_as_shipped Endpoint
tags:
  - cve.org
  - exploit-available
ingestedAt: '2026-10-16T18:43:08.674Z'
---

## Overview

BeikeShop through 2.0.0.31 contains an insecure direct object reference vulnerability in the markAsShipped handler of RmaController that allows authenticated customers to modify other customers' returns. Attackers can submit sequential RMA ids to the account/rmas/{id}/mark_as_shipped endpoint to overwrite courier names and tracking numbers and mark approved returns as shipped.

## Affected

- `beikeshop <= 2.0.0.31`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.