CVE-2026-129469
Deferred Deferred - Pending Action

Insecure Direct Object Reference in Course Tencent Cloud

Publication date: 2026-11-15

Last updated on: 2026-11-15

Assigner: VulnCheck

Description
Course-tencent-cloud before 2.0.2 contains an insecure direct object reference vulnerability that allows unauthenticated attackers to view other users' refund previews by supplying an order sn to /api/refund/confirm. Attackers can compute valid sn values from Sqids-encoded sequential order ids using the default key to disclose ordered items, prices, refund amounts, fees and deadlines.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-15
Last Modified
2026-11-15
Generated
2026-11-15
AI Q&A
2026-11-15
EPSS Evaluated
N/A
NVD
CVE-2026-129469
EUVD
EUVD-2026-126019

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
tencent course to 2.0.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an Insecure Direct Object Reference (IDOR) in the Course-Tencent-Cloud application before version 2.0.2. It allows unauthenticated attackers to view other users' refund previews by providing an order serial number (sn) to the /api/refund/confirm endpoint. Attackers can generate valid sn values from sequential order IDs using the default key, exposing sensitive refund details like items, prices, refund amounts, fees, and deadlines.

Detection Guidance

To detect this IDOR vulnerability, check if the /api/refund/confirm endpoint lacks ownership validation. Test by sending requests with different order sn values and verify if unauthorized refund data is exposed. Use tools like curl to query the endpoint with sequential or predicted sn values.

Impact Analysis

This vulnerability allows attackers to access your refund and order data without authentication. They can view your purchased courses, payment amounts, refund details, and personal information by guessing or computing your order serial number. This could lead to privacy breaches, financial exposure, or identity theft if sensitive data is disclosed.

Compliance Impact

This vulnerability likely violates GDPR and HIPAA by exposing personal and financial data without proper access controls. GDPR requires protecting personal data, while HIPAA mandates safeguarding health-related payment information. The lack of owner checks and unauthorized data access could result in non-compliance, legal penalties, and reputational damage for organizations using this software.

Mitigation Strategies

Immediately update to version 2.0.2 or later to apply the ownership checks in RefundController.php. If updating is not possible, implement server-side validation to ensure users can only access their own refund data by comparing user IDs with order ownership.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-129469. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...