BeikeShop through version 2.0.0.31 contains an insecure direct object reference in the RmaController that allows any authenticated customer to modify return data belonging to other customers. By submitting sequential RMA identifiers to the /account/rmas/{id}/mark_as_shipped endpoint, an attacker can overwrite courier names and tracking numbers and falsely mark approved returns as shipped, thereby compromising the integrity of order fulfillment data and potentially leading to financial loss or customer dissatisfaction.

The vulnerable product is BeikeShop, with affected releases up to and including version 2.0.0.31. No other versions or variants are listed as impacted by this CVE.

The CVSS score of 5.3 indicates moderate severity, and the lack of an available EPSS score means the exploitation probability is unknown. The vulnerability is not currently listed in the CISA KEV catalog, and exploitation would require an authenticated user to send crafted requests to the marked endpoint. No public exploits have been documented, but the absence of a unique identifier and the need for authentication suggest that the attack vector is HTTP-based RMA shipping actions performed by legitimate users.