The F2FPayController.orderQuery endpoint in Roncoo-pay contains a missing authorization check. An unauthenticated attacker can supply a trxNo parameter and the service will return the full serialized payment record. Because transaction numbers can be guessed using a fixed "7" prefix followed by a snowflake ID, the attacker can enumerate records for any merchant, exposing sensitive financial data.

The vulnerability applies to the roncoo-pay product, specifically the F2FPayController implementation present in commit 9428382. Any deployment that has not been updated to a version that fixes this missing authorization control is at risk.

The CVSS score of 8.2 indicates a high severity, and the hole can be exploited remotely via the publicly exposed /f2fPay/order/query HTTP endpoint without any authentication. Although an EPSS score is not available, the nature of the flaw (unauthenticated data disclosure with predictable identifiers) suggests a realistic exploitation potential. The vulnerability is not currently listed in the CISA KEV catalog.