CVE-2026-111657 Details

A vulnerability allowing insecure direct object reference (IDOR) has been identified in BeikeShop versions through 2.0.0.31. This vulnerability exists in the 'markAsShipped' handler of the 'RmaController', where authenticated customers can manipulate other customers' return merchandise authorization (RMA) records. By sending requests to the 'account/rmas/{id}/mark_as_shipped' endpoint with sequential RMA IDs, attackers can overwrite courier names and tracking numbers, and falsely mark approved returns as shipped.

To address this vulnerability, BeikeShop should implement an ownership check in the 'markAsShipped' method of the 'RmaController'. This check should verify that the RMA being modified belongs to the currently authenticated customer, similar to the checks already in place for other RMA-related actions. Additionally, the RMA lookup should be scoped to the current customer to prevent cross-customer access.