CVE-2026-11462

Chengdu Everbrite Network Technology BeikeShop Stripe Plugin StripeController.php callback improper authorization

State: Published
Severity: 6.9 Medium
Published: Jun 7, 2026
Updated: Jun 8, 2026
Reserved: Jun 7, 2026

Description

A vulnerability was found in Chengdu Everbrite Network Technology BeikeShop up to 1.6.0.22. This impacts the function callback of the file plugins/Stripe/Controllers/StripeController.php of the component Stripe Plugin. Performing a manipulation of the argument Request results in improper authorization. The attack can be initiated remotely. The exploit has been made public and could be used. The patch is named 6719e0fc690ea0a998452092862e0f0a17c65968. It is suggested to install a patch to address this issue.

Scores

CVSS	Score	Vector	Source
4.0	6.9 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P	VulDB
3.1	7.3 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C	VulDB
3.0	7.3 High	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C	VulDB
2.0	7.5 High	AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:OF/RC:C	VulDB

Weaknesses

CWE-285 Improper Authorization
CWE-266 Incorrect Privilege Assignment

Affected Products

Product	Versions
BeikeShopChengdu Everbrite Network Technology	1.6.0.0Affected 1.6.0.1Affected 1.6.0.2Affected 1.6.0.3Affected 1.6.0.4Affected 1.6.0.5Affected 1.6.0.6Affected 1.6.0.7Affected 1.6.0.8Affected 1.6.0.9Affected 1.6.0.10Affected 1.6.0.11Affected 1.6.0.12Affected 1.6.0.13Affected 1.6.0.14Affected 1.6.0.15Affected 1.6.0.16Affected 1.6.0.17Affected 1.6.0.18Affected 1.6.0.19Affected 1.6.0.20Affected 1.6.0.21Affected 1.6.0.22Affected

References

VDB-369082 | Chengdu Everbrite Network Technology BeikeShop Stripe Plugin StripeController.php callback improper authorizationvdb-entrytechnical-description
VDB-369082 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
CVE-2026-11462 | CVE Analysis and Reportthird-party-advisory
Submit #831466 | BeikeShop 1.6.0 Design/Logic Flawthird-party-advisory
https://github.com/nuiifornet/BeikeShop-Vulnerability/blob/main/README.mdexploit
https://github.com/beikeshop/beikeshop/commit/6719e0fc690ea0a998452092862e0f0a17c65968patch

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.