CVE-2026-111697
Received Received - Intake

Insecure Direct Object Reference in HUIZHI ChargeOS Cloud

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: VulnCheck

Description
HUIZHI ChargeOS cloud through 3.0.9 contains an insecure direct object reference vulnerability in the hcp-mp MeController and OrderController that trusts client-supplied userId, openId and orderNumber parameters. Attackers can enumerate sequential member ids against endpoints like /me/getMemberBalanceByUserId and /order/orderDetail to read any member's wallet, credit, profile and charging orders.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-16
AI Q&A
2026-10-16
EPSS Evaluated
N/A
NVD
CVE-2026-111697
EUVD
EUVD-2026-102988

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
roinli HUIZHI-ChargeOS-cloud 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

HUIZHI ChargeOS cloud through version 3.0.9 has an insecure direct object reference (IDOR) vulnerability. It allows attackers to manipulate parameters like userId, openId, and orderNumber in endpoints such as /me/getMemberBalanceByUserId and /order/orderDetail. This enables unauthorized access to sensitive data including wallet balances, credit information, user profiles, and charging orders.

Detection Guidance

To detect this vulnerability, check for endpoints like /me/getMemberBalanceByUserId and /order/orderDetail that accept userId, openId, or orderNumber parameters without proper authorization. Use tools like curl to send requests with sequential IDs and observe if unauthorized data is returned.

Impact Analysis

This vulnerability allows attackers to access and steal personal and financial data of users, including wallet balances, credit details, and charging orders. It can lead to identity theft, financial fraud, and unauthorized transactions. Users may face privacy breaches and financial losses.

Compliance Impact

This vulnerability likely violates GDPR due to unauthorized access to personal data and HIPAA if health-related charging data is exposed. It results in non-compliance with data protection requirements, leading to legal penalties, reputational damage, and mandatory breach notifications.

Mitigation Strategies

Immediately update HUIZHI ChargeOS cloud to the latest version beyond 3.0.9. Implement strict input validation and authorization checks on all endpoints handling userId, openId, and orderNumber parameters. Restrict access to sensitive endpoints and log all access attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111697. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart