Description
roncoo-education through 25.0.0-RELEASE contains an insecure direct object reference vulnerability that allows authenticated users to cancel or continue payment on other users' orders. Attackers can supply another user's order number to the pay cancel or continue endpoints to close pending orders or read course ids and prices.
Published: 2026-10-16
Score: 5.3 Medium
EPSS: n/a
KEV: No
Impact: Insecure Direct Object Reference allowing authorized users to cancel or continue other users' orders
Action: Update Application
AI Analysis

Impact

The vulnerability is an insecure direct object reference in the roncoo-education web application. Authenticated users can supply another user’s order number to the pay cancel or continue endpoints, allowing them to close pending orders or read the associated course IDs and prices, bypassing normal authorization controls.

Affected Systems

roncoo on the roncoo-education product, version 25.0.0-RELEASE is affected.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting no known public exploits. Exploitation requires a logged‑in user with knowledge or guessing of another user’s order ID, after which the insecure endpoints can be abused. Given these conditions, the risk is moderate but still actionable.

Generated by OpenCVE AI on October 16, 2026 at 18:16 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade roncoo-education to a patched version where the IDOR is resolved (e.g., 25.0.1 or later).
  • Modify the cancel and continue order endpoints to validate that the order ID belongs to the authenticated user before processing the request.
  • Enforce strict access control on these endpoints, ensuring only authorized users can invoke them, and consider disabling them for non‑admin roles if business logic permits.

Generated by OpenCVE AI on October 16, 2026 at 18:16 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 16 Oct 2026 17:45:00 +0000

Type Values Removed Values Added
Description roncoo-education through 25.0.0-RELEASE contains an insecure direct object reference vulnerability that allows authenticated users to cancel or continue payment on other users' orders. Attackers can supply another user's order number to the pay cancel or continue endpoints to close pending orders or read course ids and prices.
Title roncoo-education through 25.0.0-RELEASE IDOR via Order Pay Cancel and Continue Endpoints
First Time appeared Roncoo
Roncoo roncoo-education
Weaknesses CWE-639
CPEs cpe:2.3:a:roncoo:roncoo-education:*:*:*:*:*:*:*:*
Vendors & Products Roncoo
Roncoo roncoo-education
References
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Roncoo Roncoo-education
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-16T17:38:51.139Z

Reserved: 2026-10-16T14:31:09.522Z

Link: CVE-2026-111611

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-16T18:17:40.383

Modified: 2026-10-16T18:17:40.383

Link: CVE-2026-111611

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-16T18:30:14Z

Weaknesses
  • CWE-639

    Authorization Bypass Through User-Controlled Key