Live › vulnerability › CVE-2026-111697
Go to dashboardHUIZHI ChargeOS cloud through 3.0.9 trusts client-supplied userId, openId and orderNumber values in its hcp-mp controllers without checking ownership. An attacker can enumerate sequential member IDs to read any member's wallet balance, credit, profile and charging orders.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Operators who self-host HUIZHI ChargeOS cloud (a Spring Cloud EV-charging platform) up to 3.0.9 and expose the hcp-mp mini-program API. The gateway requires a valid member login, but any logged-in member can read other members' wallet, credit, profile and orders by changing sequential IDs. The researcher also reports a recharge endpoint (/pay/xcxRecharge) lets a member add balance without payment (tracked separately). Anyone not running this platform can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| HUIZHI-ChargeOS-cloud | vendor | <= 3.0.9 | – |
3.0.9 (master commit 1a2cbab or earlier)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
HUIZHI ChargeOS cloud through 3.0.9 contains an insecure direct object reference vulnerability in the hcp-mp MeController and OrderController that trusts client-supplied userId, openId and orderNumber parameters. Attackers can enumerate sequential member ids against endpoints like /me/getMemberBalanceByUserId and /order/orderDetail to read any member's wallet, credit, profile and charging orders.
This page as .md · .json · in your agent: get_signal("CVE-2026-111697")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.