CVE-2026-124576 Details
Description
A security flaw has been discovered in BeikeShop up to 2.0.0.31. Impacted is the function OrderRepo::getOrderByNumber of the file beike/Repositories/OrderRepo.php of the component Guest Order Lookup. Performing a manipulation of the argument order_number results in enforcement of behavioral workflow. The attack can be initiated remotely. Upgrading to version 2.0.0.32 is recommended to address this issue. The patch is named 6cf25f8c15d27d1ff14a848faf645c94d20ba5f1. It is recommended to upgrade the affected component.
A vulnerability exists in BeikeShop versions through 2.0.0.31 within the Guest Order Lookup component. The issue arises in the OrderRepo::getOrderByNumber function, located in beike/Repositories/OrderRepo.php. The vulnerability allows for manipulation of the order_number argument, disrupting the expected workflow. This issue can be exploited remotely.
Users are advised to upgrade to BeikeShop version 2.0.0.32, which addresses this vulnerability by implementing proper authorization checks for guest orders and enhancing the payment verification process.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/beikeshop/beikeshop/ | [email protected] | ProductSource CodeVendor |
| https://github.com/beikeshop/beikeshop/commit/6cf25f8c15d27d1ff14a848faf645c94d20ba5f1 | [email protected] | Source CodeVendor |
| https://github.com/beikeshop/beikeshop/releases/tag/v2.0.0.32 | [email protected] | Release NotesVendor |
| https://github.com/beikeshop/beikeshop/security/advisories/GHSA-p2x8-f9cm-m352 | [email protected] | AdvisoryBroken LinkVendor |
| https://vuldb.com/cve/CVE-2026-124576 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/1038160 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/432922 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/432922/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-840 | Business Logic Errors | [email protected] |
| CWE-841 | Improper Enforcement of Behavioral Workflow | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| BeikeShop | <= 2.0.0.31 |
CPE
Remediation
| |
Change History
1 change record found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 9, 2026 | New CVE Received | [email protected] |