Description
HUIZHI ChargeOS cloud through 3.0.9 contains an insecure direct object reference vulnerability in the hcp-mp MeController and OrderController that trusts client-supplied userId, openId and orderNumber parameters. Attackers can enumerate sequential member ids against endpoints like /me/getMemberBalanceByUserId and /order/orderDetail to read any member's wallet, credit, profile and charging orders.
Published: 2026-10-16
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: Insecure Direct Object Reference exposing member wallet, credit, profile, and order data
Action: Apply Patch
AI Analysis

Impact

The vulnerable HUIZHI ChargeOS cloud releases up to version 3.0.9 expose a classic IDOR flaw in the MeController and OrderController APIs. These endpoints accept client‑supplied userId, openId and orderNumber parameters and directly query data without validating that the caller is authorized to view that particular member’s information. An attacker who can send requests to endpoints such as /me/getMemberBalanceByUserId or /order/orderDetail can sequentially enumerate member identifiers and retrieve another user’s wallet balance, credit history, profile details, and charging orders, effectively compromising sensitive personal and financial data for all members.

Affected Systems

The flaw exists in HUIZHI ChargeOS cloud from the roinli vendor, affecting all releases up to and including version 3.0.9. No later versions are listed in the advisory data.

Risk and Exploitability

The CVSS score of 7.1 indicates a high‑severity risk. While the EPSS score is not available, the vulnerability is accessible over the network through the documented REST endpoints, making it remotely exploitable by an attacker with knowledge of ordinal member identifiers. The flaw is not listed in CISA’s KEV catalog, but the impact on confidentiality and potential for widespread data leakage warrants immediate attention.

Generated by OpenCVE AI on October 16, 2026 at 19:03 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest vendor patch or upgrade HUIZHI ChargeOS cloud to a release newer than 3.0.9.
  • If an update cannot be applied immediately, modify the API logic to verify that the authenticated user’s identity matches the userId or openId supplied in the request, rejecting any mismatch.
  • Enforce strict access controls so that only the owner of a member’s data can query that data, and consider implementing rate limiting or enumeration detection on the affected endpoints.

Generated by OpenCVE AI on October 16, 2026 at 19:03 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 26 Oct 2026 19:45:00 +0000

Type Values Removed Values Added
First Time appeared Roinli
Roinli huizhi-chargeos-cloud
Vendors & Products Roinli
Roinli huizhi-chargeos-cloud

Sat, 17 Oct 2026 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 16 Oct 2026 17:45:00 +0000

Type Values Removed Values Added
Description HUIZHI ChargeOS cloud through 3.0.9 contains an insecure direct object reference vulnerability in the hcp-mp MeController and OrderController that trusts client-supplied userId, openId and orderNumber parameters. Attackers can enumerate sequential member ids against endpoints like /me/getMemberBalanceByUserId and /order/orderDetail to read any member's wallet, credit, profile and charging orders.
Title HUIZHI ChargeOS cloud through 3.0.9 IDOR via hcp-mp Member and Order APIs
Weaknesses CWE-639
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}

cvssV4_0

{'score': 7.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Roinli Huizhi-chargeos-cloud
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-16T18:15:00.443Z

Reserved: 2026-10-16T14:31:21.309Z

Link: CVE-2026-111697

cve-icon Vulnrichment

Updated: 2026-10-16T18:14:55.111Z

cve-icon NVD

Status : Deferred

Published: 2026-10-16T18:17:53.350

Modified: 2026-10-16T19:17:05.007

Link: CVE-2026-111697

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-26T19:27:08Z

Weaknesses
  • CWE-639

    Authorization Bypass Through User-Controlled Key