BeikeShop Order Lookup Parameter Manipulation Flaw

CVE-2026-124576 affects BeikeShop versions up to 2.0.0.31 through a parameter manipulation vulnerability in the OrderRepo::getOrderByNumber function. An attacker can manipulate the order_number argument to bypass intended workflow enforcement in the guest order lookup component, allowing unauthorized access to order information or system state manipulation. This vulnerability is particularly concerning for e-commerce platforms as it undermines the security controls designed to restrict guest users from accessing sensitive order data. Any organization running vulnerable versions of BeikeShop—especially those handling customer transactions and order management—faces risk of information disclosure and potential order tampering without authentication.

While this CVE does not map to specific MITRE ATT&CK techniques in current frameworks, Casky's Claude-powered analysis would detect the underlying attack patterns through its 754 mapped security skills. Practitioners using Casky would observe findings related to improper input validation (CWE-840, CWE-841) that facilitate unauthorized access to restricted functionality. The extended reasoning capability would highlight the behavioral workflow bypass as indicative of Access Control abuse—practitioners would see detection signals for unauthenticated privilege escalation attempts where guest users access order data intended for authenticated owners. Mitigation requires immediate patching to version 2.0.0.32 and review of access control implementations across guest-facing components.