{"metadata": {"vulnerability": "CVE-2026-124576", "count": 19, "kinds": {"milestone": 4, "sighting": 4, "kev": 0, "other": 11}, "linked_omitted": 0}, "data": [{"timestamp": "2026-11-08T00:00:00Z", "date_only": false, "value": "2026-11-08T00:00:00.000Z", "kind": "other", "label": "Timeline", "source": "cvelistv5 / VulDB", "record": "CVE-2026-124576", "field": "containers.cna.timeline.0.time", "text": "Advisory disclosed"}, {"timestamp": "2026-11-08T01:00:00Z", "date_only": false, "value": "2026-11-08T01:00:00.000Z", "kind": "other", "label": "Timeline", "source": "cvelistv5 / VulDB", "record": "CVE-2026-124576", "field": "containers.cna.timeline.1.time", "text": "VulDB entry created"}, {"timestamp": "2026-11-08T16:59:31.143Z", "date_only": false, "value": "2026-11-08T16:59:31.143Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-124576", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-11-08T18:04:40Z", "date_only": false, "value": "2026-11-08T18:04:40.000Z", "kind": "other", "label": "Timeline", "source": "cvelistv5 / VulDB", "record": "CVE-2026-124576", "field": "containers.cna.timeline.2.time", "text": "VulDB entry last update"}, {"timestamp": "2026-11-09T07:00:23.096Z", "date_only": false, "value": "2026-11-09T07:00:23.096Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-124576", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-09T07:00:23.096Z", "date_only": false, "value": "2026-11-09T07:00:23.096Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / VulDB", "record": "CVE-2026-124576", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-09T07:01:57.637Z", "date_only": false, "value": "2026-11-09T07:01:57.637165Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117585196897533845", "record": "CVE-2026-124576", "field": "creation_timestamp", "uuid": "ce675308-d5cb-4814-84ff-1b1051b79106", "content": "CVE-2026-124576 BeikeShop Guest Order Lookup OrderRepo.php getOrderByNumber behavioral workflow A security flaw has been discovered in BeikeShop up to 2.0.0.31. Impacted is the function OrderRepo::getOrderByNumber of the file beike/Repositories/OrderRepo.php of the component Guest Order Lookup. Performing a manipulation of the argument order_number results in enforcement of behavioral workflow. The attack can be initiated remotely. Upgrading to version 2.0.0.32 is recommended to address this issue. The patch is named 6cf25f8c15d27d1ff14a848faf645c94d20ba5f1. It is recommended to upgrade the affected component.\nhttps://www.cve.org/CVERecord?id=CVE-2026-124576https://vuldb.com/vuln/432922https://vuldb.com/vuln/432922/ctihttps://vuldb.com/cve/CVE-2026-124576https://vuldb.com/submit/1038160https://github.com/beikeshop/beikeshop/security/advisories/GHSA-p2x8-f9cm-m352https://github.com/beikeshop/beikeshop/commit/6cf25f8c15d27d1ff14a848faf645c94d20ba5f1https://github.com/beikeshop/beikeshop/releases/tag/v2.0.0.32https://github.com/beikeshop/beikeshop/#CVE_2026_124576#bot", "url": "https://infosec.exchange/users/cve/statuses/117585196897533845"}, {"timestamp": "2026-11-09T07:17:32Z", "date_only": false, "value": "2026-11-09T07:17:32Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-5655-HP8H-9FFJ", "record": "GHSA-5655-HP8H-9FFJ", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-11-09T07:17:32.757Z", "date_only": false, "value": "2026-11-09T07:17:32.757", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-124576", "record": "FKIE_CVE-2026-124576", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-09T07:55:44.556Z", "date_only": false, "value": "2026-11-09T07:55:44.556051Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/dyupgzrkxz5oy", "record": "CVE-2026-124576", "field": "creation_timestamp", "uuid": "a2fa78c8-d111-42c3-95a8-6fda45271baf", "content": "CVE-2026-124576 - BeikeShop Guest Order Lookup OrderRepo.php getOrderByNumber behavioral workflow\nCVE ID : CVE-2026-124576\n \n Published : Nov. 9, 2026, 7 a.m. | 21\u00a0minutes ago\n \n Description : A security flaw has been discovered in BeikeShop up to 2.0.0.31. Impacted is the fun...", "url": "https://bsky.app/profile/cve.skyfleet.blue/post/dyupgzrkxz5oy"}, {"timestamp": "2026-11-09T09:31:43Z", "date_only": false, "value": "2026-11-09T09:31:43Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-5655-HP8H-9FFJ", "record": "GHSA-5655-HP8H-9FFJ", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-09T09:31:44Z", "date_only": false, "value": "2026-11-09T09:31:44Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-5655-HP8H-9FFJ", "record": "GHSA-5655-HP8H-9FFJ", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-09T11:00:12Z", "date_only": false, "value": "2026-11-09T11:00:12.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/kQ7y76hupNbVvlHhcq7wgYIuJQwxm8Zz91sadqYUp-xsg4k", "record": "CVE-2026-124576", "field": "creation_timestamp", "uuid": "0445af8f-79f7-442f-a683-bf7919ddab7e"}, {"timestamp": "2026-11-09T17:00:07Z", "date_only": false, "value": "2026-11-09T17:00:07.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/109838", "record": "CVE-2026-124576", "field": "creation_timestamp", "uuid": "9edfe580-a560-436f-be2d-e3f31732ae4b", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-124576\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a capivara-research\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-11-09 16:39:32\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-124576: BeikeShop PayPal payment bypass and guest-order IDOR \u2014 bilingual analysis and safe PoC\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/109838", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-11-12T14:39:21.513Z", "date_only": false, "value": "2026-11-12T14:39:21.513940Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-124576", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-11-12T14:39:21.513Z", "date_only": false, "value": "2026-11-12T14:39:21.513940Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-124576", "record": "FKIE_CVE-2026-124576", "field": "metrics.ssvcV203.0.ssvcData.timestamp", "linked_record": true}, {"timestamp": "2026-11-12T14:39:41.405Z", "date_only": false, "value": "2026-11-12T14:39:41.405Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-124576", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-11-12T14:39:41.405Z", "date_only": false, "value": "2026-11-12T14:39:41.405Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-124576", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-12T15:17:48.510Z", "date_only": false, "value": "2026-11-12T15:17:48.510", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-124576", "record": "FKIE_CVE-2026-124576", "field": "lastModified", "linked_record": true}], "metrics": {"as_of": "2026-11-13T16:29:15.655Z", "anchors": {"origin": {"timestamp": "2026-11-09T07:00:23.096Z", "date_only": false, "value": "2026-11-09T07:00:23.096Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-124576", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-11-09T07:00:23.096Z", "date_only": false, "value": "2026-11-09T07:00:23.096Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-124576", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": {"timestamp": "2026-11-09T17:00:07Z", "date_only": false, "value": "2026-11-09T17:00:07.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/109838", "record": "CVE-2026-124576", "field": "creation_timestamp", "uuid": "9edfe580-a560-436f-be2d-e3f31732ae4b", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-124576\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a capivara-research\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-11-09 16:39:32\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-124576: BeikeShop PayPal payment bypass and guest-order IDOR \u2014 bilingual analysis and safe PoC\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/109838", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": true, "seconds": 35983.904, "hours": 9.99552888888889, "days": 0.4164803703703704, "min_seconds": 35983.904, "max_seconds": 35983.904, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-11-09T07:00:23.096Z", "date_only": false, "value": "2026-11-09T07:00:23.096Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-124576", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-09T17:00:07Z", "date_only": false, "value": "2026-11-09T17:00:07.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/109838", "record": "CVE-2026-124576", "field": "creation_timestamp", "uuid": "9edfe580-a560-436f-be2d-e3f31732ae4b", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-124576\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a capivara-research\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-11-09 16:39:32\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-124576: BeikeShop PayPal payment bypass and guest-order IDOR \u2014 bilingual analysis and safe PoC\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/109838", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 379732.559019, "hours": 105.48126639416667, "days": 4.3950527664236105, "min_seconds": 379732.559019, "max_seconds": 379732.559019, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-11-09T07:00:23.096Z", "date_only": false, "value": "2026-11-09T07:00:23.096Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-124576", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-13T16:29:15.655Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": true, "seconds": 343748.655019, "hours": 95.48573750527778, "days": 3.9785723960532406, "min_seconds": 343748.655019, "max_seconds": 343748.655019, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-11-09T17:00:07Z", "date_only": false, "value": "2026-11-09T17:00:07.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/109838", "record": "CVE-2026-124576", "field": "creation_timestamp", "uuid": "9edfe580-a560-436f-be2d-e3f31732ae4b", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-124576\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a capivara-research\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-11-09 16:39:32\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-124576: BeikeShop PayPal payment bypass and guest-order IDOR \u2014 bilingual analysis and safe PoC\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/109838", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "end": {"timestamp": "2026-11-13T16:29:15.655Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}}}