Vulnerability record/PUBLISHED/Published Nov 9, 2026 07:00:23 UTC
CVE-2026-124576
A security flaw has been discovered in BeikeShop up to 2.0.0.31. Impacted is the function OrderRepo::getOrderByNumber of the file beike/Repositories/OrderRepo.php of the component Guest Order Lookup. Performing a manipulation of the argument order_number results in enforcement of behavioral workflow. The attack can be initiated remotely. Upgrading to version 2.0.0.32 is recommended to address this issue. The patch is named 6cf25f8c15d27d1ff14a848faf645c94d20ba5f1. It is recommended to upgrade the affected component.
Base score6.9/ 10
SeverityMediumCVSS 4.0
Exploitability / impact
CVSS metric breakdown
Base severityMedium
Attack vectorNetworkAV
Attack complexityLowAC
Attack requirementsNoneAT
Privileges requiredNonePR
User interactionNoneUI
Vulnerable system confidentialityLowVC
Vulnerable system integrityLowVI
Vulnerable system availabilityLowVA
Subsequent system confidentialityNoneSC
Subsequent system integrityNoneSI
Subsequent system availabilityNoneSA
Exploit maturityNot definedE
CVSS vector string
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:XCVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.
Record context
CVE Numbering AuthorityVulDB
Last updatedNov 9, 2026 07:00:23 UTC
PublishedNov 9, 2026 07:00:23 UTC
ReservedNov 8, 2026 16:59:31 UTC
Credits
- fernando viana (VulDB User)