{"id":"CVE-2026-111611","kind":"vulnerability","aliases":["CVE-2026-111611"],"related":[],"title":"roncoo-education: authenticated users can cancel other users' pending orders","description":"roncoo-education through 25.0.0-RELEASE contains an insecure direct object reference vulnerability that allows authenticated users to cancel or continue payment on other users' orders. Attackers can supply another user's order number to the pay cancel or continue endpoints to close pending orders or read course ids and prices.","summary":"roncoo-education through 25.0.0-RELEASE lacks an ownership check on its pay cancel and continue endpoints. A logged-in user who supplies another user's order number can close that pending order or read its course ids and prices.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["java","other","roncoo-education","self-hosted"],"not_affected_if":["no-user-accounts"],"how_to_check":"- unknown","fix":"- unknown","status":"open","published_at":"2026-10-16T18:17:40+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","triaged_at":"2026-10-25T04:18:27+00:00","updated_at":"2026-10-25T04:18:27+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-25T04:18:27Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"internet","title":"roncoo-education: authenticated users can cancel other users' pending orders","impact":"low","summary":"roncoo-education through 25.0.0-RELEASE lacks an ownership check on its pay cancel and continue endpoints. A logged-in user who supplies another user's order number can close that pending order or read its course ids and prices.","category":"other","nicknames":[],"who_cares":["roncoo-education","self-hosted","java"],"confidence":0.6,"needs_auth":"yes","worst_case":"other users' pending orders get closed and course prices leak","analyst_note":"Find the patched release and the exact endpoint paths from the NVD entry or the upstream roncoo-education repository.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["no-user-accounts"],"who_is_affected":"Deployments of roncoo-education through 25.0.0-RELEASE that accept user accounts and take payments for courses. Installations without user accounts or without online orders are unlikely to be exposed. The sources do not name a patched version.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000538,"input_tokens":3319,"output_tokens":412,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-111611':14A,17A '-2026':13A,16A '25.0.0':30B,71C 'allow':81C 'anoth':50B,96C 'attack':93C 'authent':4A,82C 'cancel':7A,39B,85C,104C 'check':35B 'close':56B,109C 'contain':73C 'continu':41B,87C,106C 'cours':63B,114C 'cve':12A,15A 'direct':76C 'educ':3A,22B,28B,69C 'endpoint':42B,107C 'host':25B 'id':64B,115C 'insecur':75C 'java':18B 'lack':32B 'log':45B 'logged-in':44B 'number':54B,100C 'object':77C 'order':11A,53B,59B,92C,99C,111C 'ownership':34B 'pay':38B,103C 'payment':88C 'pend':10A,58B,110C 'price':66B,117C 'read':61B,113C 'refer':78C 'releas':31B,72C 'roncoo':2A,21B,27B,68C 'roncoo-educ':1A,20B,26B,67C 'self':24B 'self-host':23B 'suppli':49B,95C 'user':5A,9A,47B,51B,83C,91C,97C 'vulner':79C","nicknames":[],"mitigations":[],"who_affected":"Deployments of roncoo-education through 25.0.0-RELEASE that accept user accounts and take payments for courses. Installations without user accounts or without online orders are unlikely to be exposed. The sources do not name a patched version.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T18:17:40+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111611","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111611","severity":null,"published_at":"2026-10-16T18:17:40+00:00","modified_at":"2026-10-16T22:17:20+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}