---
id: "CVE-2026-111611"
kind: "vulnerability"
aliases: ["CVE-2026-111611"]
title: "roncoo-education: authenticated users can cancel other users' pending orders"
severity: "medium"
cvss: 5.4
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["java", "other", "roncoo-education", "self-hosted"]
not_affected_if: ["no-user-accounts"]
published_at: "2026-10-16T18:17:40+00:00"
first_seen_at: "2026-10-23T21:57:13+00:00"
updated_at: "2026-10-25T04:18:27+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111611", "first_seen_at": "2026-10-23T21:57:13+00:00"}]
---

# roncoo-education: authenticated users can cancel other users' pending orders

roncoo-education through 25.0.0-RELEASE lacks an ownership check on its pay cancel and continue endpoints. A logged-in user who supplies another user's order number can close that pending order or read its course ids and prices.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- unknown

## Fix

- unknown

## Timeline

- 2026-10-23T21:57:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111611

## From the sources

roncoo-education through 25.0.0-RELEASE contains an insecure direct object reference vulnerability that allows authenticated users to cancel or continue payment on other users' orders. Attackers can supply another user's order number to the pay cancel or continue endpoints to close pending orders or read course ids and prices.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_