CVE-2026-111697 — HUIZHI ChargeOS cloud through 3.0.9 IDOR via hcp-mp Member and Order APIs
HUIZHI ChargeOS cloud through 3.0.9 contains an insecure direct object reference vulnerability in the hcp-mp MeController and OrderController that trusts client-supplied userId,…
Published: 2026-10-16 · CVSS: 7.1 · CVSS 4.0
HUIZHI ChargeOS cloud through 3.0.9 contains an insecure direct object reference vulnerability in the hcp-mp MeController and OrderController that trusts client-supplied userId, openId and orderNumber parameters. Attackers can enumerate sequential member ids against endpoints like /me/getMemberBalanceByUserId and /order/orderDetail to read any member's wallet, credit, profile and charging orders.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7