A missing authorization check in the HUIZHI ChargeOS cloud PayController.xcxRecharge endpoint allows an attacker to submit requests with arbitrary userId and amount parameters, enabling them to credit or debits any member’s wallet balance at will. This flaw can lead to financial loss, unauthorized consumption of charging services, and a broader compromise of platform integrity. The problem is drawn out of the lack of authentication or authorization controls on a publicly accessible endpoint, letting attackers manipulate critical financial data without permission.

The vulnerability affects the HUIZHI ChargeOS cloud product, specifically all releases up through version 3.0.9. Users installing or running the chargeos‑cloud service on these versions are exposed to the flaw and should consider upgrading to the next patched release or applying vendor remediation if available.

With a CVSS score of 7.1 the flaw is rated medium‑high and is listed as not in the CISA KEV catalog, indicating no known widespread exploitation. Because the endpoint lacks authentication, the exploitation requires only the ability to send crafted HTTP requests to the service, which is typically possible for any network reacher. The EPSS score is not available, but the clear lack of authorization suggests that exploitation is straightforward and could be automated. Overall, the risk is elevated for environments that expose the endpoint without additional network controls or application authentication.