CVE-2026-111697
CVE-2026-111697 · HUIZHI ChargeOS cloud through 3.0.9 IDOR via hcp-mp Member and Order APIs
This page contains facts from public vulnerability sources. Check the original advisory before updating.
HUIZHI ChargeOS cloud through 3.0.9 contains an insecure direct object reference vulnerability in the hcp-mp MeController and OrderController that trusts client-supplied userId, openId and orderNumber parameters. Attackers can enumerate sequential member ids against endpoints like /me/getMemberBalanceByUserId and /order/orderDetail to read any member's wallet, credit, profile and charging orders.
CVSS 7.1 · High · EPSS 0.4%
- Published
- Updated
Affected products and versions
huizhi-chargeos-cloud
- Versions
- ≥ 0, ≤ 3.0.9: Affected (custom)
No fix published
Original sources
- https://hackmd.io/@hieuPenguinnn/huizhi-chargeos-mp-member-api-userid-idor
- https://github.com/roinli/HUIZHI-ChargeOS-cloud/blob/1a2cbab79bb7abe7df3b4f9977f5d0e18e65bd4a/hcp-modules/hcp-mp/src/main/java/com/hcp/mp/controller/MeController.java#L40-L91
- https://github.com/roinli/HUIZHI-ChargeOS-cloud/blob/1a2cbab79bb7abe7df3b4f9977f5d0e18e65bd4a/hcp-modules/hcp-mp/src/main/java/com/hcp/mp/controller/OrderController.java#L59-L87
- https://www.vulncheck.com/advisories/huizhi-chargeos-cloud-through-3.0.9-idor-via-hcp-mp-member-and-order-apis
- https://nvd.nist.gov/vuln/detail/CVE-2026-111697