CVE-2026-124576
Full vulnerability record from the local CVENow database.
Description
A security flaw has been discovered in BeikeShop up to 2.0.0.31. Impacted is the function OrderRepo::getOrderByNumber of the file beike/Repositories/OrderRepo.php of the component Guest Order Lookup. Performing a manipulation of the argument order_number results in enforcement of behavioral workflow. The attack can be initiated remotely. Upgrading to version 2.0.0.32 is recommended to address this issue. The patch is named 6cf25f8c15d27d1ff14a848faf645c94d20ba5f1. It is recommended to upgrade the affected component.
Severity
MEDIUM
CVSS score
6.9
(v4.0)
Vulnerability status
Deferred
Source identifier
Published
2026-11-09 07:17:32.757000
Last modified
2026-11-09 07:17:32.983000
View original CVE JSON
{
"id": "CVE-2026-124576",
"sourceIdentifier": "[email protected]",
"published": "2026-11-09T07:17:32.757",
"lastModified": "2026-11-09T07:17:32.983",
"vulnStatus": "Deferred",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A security flaw has been discovered in BeikeShop up to 2.0.0.31. Impacted is the function OrderRepo::getOrderByNumber of the file beike/Repositories/OrderRepo.php of the component Guest Order Lookup. Performing a manipulation of the argument order_number results in enforcement of behavioral workflow. The attack can be initiated remotely. Upgrading to version 2.0.0.32 is recommended to address this issue. The patch is named 6cf25f8c15d27d1ff14a848faf645c94d20ba5f1. It is recommended to upgrade the affected component."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "n/a",
"product": "BeikeShop",
"cpes": [
"cpe:2.3:a:beikeshop:beikeshop:*:*:*:*:*:*:*:*"
],
"modules": [
"Guest Order Lookup"
],
"versions": [
{
"version": "2.0.0.0",
"status": "affected"
},
{
"version": "2.0.0.1",
"status": "affected"
},
{
"version": "2.0.0.2",
"status": "affected"
},
{
"version": "2.0.0.3",
"status": "affected"
},
{
"version": "2.0.0.4",
"status": "affected"
},
{
"version": "2.0.0.5",
"status": "affected"
},
{
"version": "2.0.0.6",
"status": "affected"
},
{
"version": "2.0.0.7",
"status": "affected"
},
{
"version": "2.0.0.8",
"status": "affected"
},
{
"version": "2.0.0.9",
"status": "affected"
},
{
"version": "2.0.0.10",
"status": "affected"
},
{
"version": "2.0.0.11",
"status": "affected"
},
{
"version": "2.0.0.12",
"status": "affected"
},
{
"version": "2.0.0.13",
"status": "affected"
},
{
"version": "2.0.0.14",
"status": "affected"
},
{
"version": "2.0.0.15",
"status": "affected"
},
{
"version": "2.0.0.16",
"status": "affected"
},
{
"version": "2.0.0.17",
"status": "affected"
},
{
"version": "2.0.0.18",
"status": "affected"
},
{
"version": "2.0.0.19",
"status": "affected"
},
{
"version": "2.0.0.20",
"status": "affected"
},
{
"version": "2.0.0.21",
"status": "affected"
},
{
"version": "2.0.0.22",
"status": "affected"
},
{
"version": "2.0.0.23",
"status": "affected"
},
{
"version": "2.0.0.24",
"status": "affected"
},
{
"version": "2.0.0.25",
"status": "affected"
},
{
"version": "2.0.0.26",
"status": "affected"
},
{
"version": "2.0.0.27",
"status": "affected"
},
{
"version": "2.0.0.28",
"status": "affected"
},
{
"version": "2.0.0.29",
"status": "affected"
},
{
"version": "2.0.0.30",
"status": "affected"
},
{
"version": "2.0.0.31",
"status": "affected"
},
{
"version": "2.0.0.32",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW",
"vulnAvailabilityImpact": "LOW",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "LOW"
},
"exploitabilityScore": 3.9,
"impactScore": 3.4
}
],
"cvssMetricV2": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "2.0",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"baseScore": 7.5,
"accessVector": "NETWORK",
"accessComplexity": "LOW",
"authentication": "NONE",
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"availabilityImpact": "PARTIAL"
},
"baseSeverity": "HIGH",
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"acInsufInfo": false,
"obtainAllPrivilege": false,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-840"
},
{
"lang": "en",
"value": "CWE-841"
}
]
}
],
"references": [
{
"url": "https://github.com/beikeshop/beikeshop/",
"source": "[email protected]"
},
{
"url": "https://github.com/beikeshop/beikeshop/commit/6cf25f8c15d27d1ff14a848faf645c94d20ba5f1",
"source": "[email protected]"
},
{
"url": "https://github.com/beikeshop/beikeshop/releases/tag/v2.0.0.32",
"source": "[email protected]"
},
{
"url": "https://github.com/beikeshop/beikeshop/security/advisories/GHSA-p2x8-f9cm-m352",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/cve/CVE-2026-124576",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/submit/1038160",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/vuln/432922",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/vuln/432922/cti",
"source": "[email protected]"
}
]
}