high
advisory
BeikeShop: Guest Order Lookup parameter manipulation (CVE-2026-124576)
A security flaw in BeikeShop up to 2.0.0.31 in the Guest Order Lookup feature allows for remote manipulation of the order_number argument.
CVE search metadata
CVE search record: CVE-2026-124576. Severity: high. CVSS: 7.3. KEV: no. Product: BeikeShop (<= 2.0.0.31). Brief: BeikeShop: Guest Order Lookup parameter manipulation (CVE-2026-124576). Brief link: https://feed.craftedsignal.io/briefs/2026-11-beikeshop-order-repo/
Triage facts
Revision 1- Applicability
- BeikeShop (<= 2.0.0.31)
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Nov 9, 07:32 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
A security flaw has been discovered in BeikeShop up to 2.0.0.31. The vulnerability exists in the OrderRepo::getOrderByNumber function within beike/Repositories/OrderRepo.php of the Guest Order Lookup component. Manipulation of the order_number argument results in the enforcement of behavioral workflow. The attack can be initiated remotely.