Technical impact
The vulnerability is an insecure direct object reference in Course‑Tencent‑Cloud that allows an unauthenticated attacker to obtain refund preview data for other users by supplying an order serial number to the /api/refund/confirm endpoint. This can expose ordered items, prices, refund amounts, fees, and deadlines, effectively leaking confidential customer purchase details. The weakness is a classic ownership check bypass identified as CWE‑639.
Affected Systems
The affected product is Course‑Tencent‑Cloud from vendor xiaochong0302. Versions prior to 2.0.2, including 2.0.1, are vulnerable. No specific CPE strings are listed, but any deployment using those releases is susceptible.
Risk and Exploitability
The listed CVSS score of 6.9 indicates a medium severity impact. EPSS information is not available, which makes it unclear how frequently attackers target this flaw, but the vulnerability can be exploited by sending a simple HTTP request to /api/refund/confirm with a crafted order sn derived from the default Sqids key. Because the attack requires no user authentication, the potential for widespread abuse is significant. The CVE is not listed in CISA KEV, but the combination of ease of discovery and lack of authentication still warrants attention.
