{"id":"CVE-2026-111697","kind":"vulnerability","aliases":["CVE-2026-111697"],"related":[],"title":"HUIZHI ChargeOS cloud: member wallet and order data readable by changing IDs","description":"HUIZHI ChargeOS cloud through 3.0.9 contains an insecure direct object reference vulnerability in the hcp-mp MeController and OrderController that trusts client-supplied userId, openId and orderNumber parameters. Attackers can enumerate sequential member ids against endpoints like /me/getMemberBalanceByUserId and /order/orderDetail to read any member's wallet, credit, profile and charging orders.","summary":"HUIZHI ChargeOS cloud through 3.0.9 trusts client-supplied userId, openId and orderNumber values in its hcp-mp controllers without checking ownership. An attacker can enumerate sequential member IDs to read any member's wallet balance, credit, profile and charging orders.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"HUIZHI-ChargeOS-cloud","fixed":[],"affected":"<= 3.0.9","ecosystem":"vendor"}],"ecosystems":[],"tags":["auth-required","ev-charging","hcp-mp","hucizhi-chargeos","huizhi-chargeos","idor","self-hosted","spring-cloud","vendor"],"not_affected_if":["hcp-mp-not-exposed","patched-release"],"how_to_check":"Check whether you run HUIZHI-ChargeOS-cloud at or before 3.0.9 (master commit 1a2cbab or earlier). In hcp-modules/hcp-mp/.../MeController.java and OrderController.java, look for @RequestParam(\"userId\") with the SecurityUtils.getUserId() line commented out. Then, logged in as one member, call GET /me/getMemberBalanceByUserId?userId=<another member id>; data returned means exposed.","fix":"No fixed release known. No release tag and no vendor advisory; latest master (commit 1a2cbab, V3.0.9) is vulnerable. Interim: patch hcp-mp controllers (MeController, OrderController, PayController) to use SecurityUtils.getUserId() instead of request userId/openId, and scope orderDetail by owner.","status":"open","published_at":"2026-10-16T18:17:53+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","triaged_at":"2026-10-25T03:36:29+00:00","updated_at":"2026-10-25T03:45:44+00:00","category":"vendor","confidence":0.8,"triage":{"at":"2026-10-25T03:36:29Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"HUIZHI ChargeOS cloud: member wallet and order data readable by changing IDs","impact":"medium","summary":"HUIZHI ChargeOS cloud through 3.0.9 trusts client-supplied userId, openId and orderNumber values in its hcp-mp controllers without checking ownership. An attacker can enumerate sequential member IDs to read any member's wallet balance, credit, profile and charging orders.","category":"vendor","nicknames":[],"who_cares":["hucizhi-chargeos","ev-charging","self-hosted","hcp-mp"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attackers read any member's wallet, credit, profile and charging orders","analyst_note":"Find the fixed version after 3.0.9 and whether the hcp-mp endpoints require a login token, via the NVD entry and the vendor advisory.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["patched-release"],"who_is_affected":"Operators running HUIZHI ChargeOS cloud up to and including 3.0.9 that expose the hcp-mp member endpoints such as /me/getMemberBalanceByUserId and /order/orderDetail. Deployments on a patched release or with these endpoints not reachable can skip it. The sources do not say whether a vendor-hosted instance is covered.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000599,"input_tokens":3371,"output_tokens":523,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the fixed version after 3.0.9 and whether the hcp-mp endpoints require a login token, via the NVD entry and the vendor advisory.","search":"'-111697':15A,18A '-2026':14A,17A '/me/getmemberbalancebyuserid':127C '/order/orderdetail':129C '3.0.9':50B,92C 'attack':70B,118C 'auth':24B 'auth-requir':23B 'balanc':82B 'chang':11A 'charg':28B,86B,139C 'chargeo':2A,34B,37B,47B,89C 'chargeos':21A 'check':67B 'client':53B,111C 'client-suppli':52B,110C 'cloud':3A,22A,44B,48B,90C 'contain':93C 'control':65B 'credit':83B,136C 'cve':13A,16A 'data':8A 'direct':96C 'endpoint':125C 'enumer':72B,120C 'ev':27B 'ev-charg':26B 'hcp':30B,63B,103C 'hcp-mp':29B,62B,102C 'host':41B 'hucizhi':33B 'hucizhi-chargeo':32B 'huizhi':1A,20A,36B,46B,88C 'huizhi-chargeo':35B 'huizhi-chargeos-cloud':19A 'id':12A,75B,123C 'idor':38B 'insecur':95C 'like':126C 'mecontrol':105C 'member':4A,74B,79B,122C,133C 'mp':31B,64B,104C 'object':97C 'openid':56B,114C 'order':7A,87B,140C 'ordercontrol':107C 'ordernumb':58B,116C 'ownership':68B 'paramet':117C 'profil':84B,137C 'read':77B,131C 'readabl':9A 'refer':98C 'requir':25B 'self':40B 'self-host':39B 'sequenti':73B,121C 'spring':43B 'spring-cloud':42B 'suppli':54B,112C 'trust':51B,109C 'userid':55B,113C 'valu':59B 'vendor':45B 'vulner':99C 'wallet':5A,81B,135C 'without':66B","nicknames":[],"mitigations":[],"who_affected":"Operators who self-host HUIZHI ChargeOS cloud (a Spring Cloud EV-charging platform) up to 3.0.9 and expose the hcp-mp mini-program API. The gateway requires a valid member login, but any logged-in member can read other members' wallet, credit, profile and orders by changing sequential IDs. The researcher also reports a recharge endpoint (/pay/xcxRecharge) lets a member add balance without payment (tracked separately). Anyone not running this platform can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T18:17:53+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111697","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111697","severity":null,"published_at":"2026-10-16T18:17:53+00:00","modified_at":"2026-10-16T19:17:05+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-111697:785","url":null,"severity":null,"published_at":"2026-10-25T03:45:44+00:00","modified_at":"2026-10-25T03:45:44+00:00","first_seen_at":"2026-10-25T03:45:44+00:00","fetched_at":"2026-10-25T03:45:44+00:00","note":"No fixed version exists: no release tags, latest master commit 1a2cbab (V3.0.9, 2026-04-30) is the vulnerable one; vendor has no advisory. Endpoints DO require login: gateway AuthFilter checks JWT plus Redis session, so attacker needs any member account (matches PR:L). Read from VulnCheck advisory, researcher writeup (source review only, not executed) and MeController source. Not marking anything verified (no vendor words)."}],"documents":[{"id":3324,"url":"https://www.vulncheck.com/advisories/huizhi-chargeos-cloud-through-3.0.9-idor-via-hcp-mp-member-and-order-apis","title":"VulnCheck: HUIZHI ChargeOS cloud through 3.0.9 IDOR","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":3311,"url":"https://hackmd.io/@hieuPenguinnn/huizhi-chargeos-mp-member-api-userid-idor","title":"hieuPenguinnn: HUIZHI-ChargeOS-cloud hcp-mp userId IDOR writeup (source review, not executed)","kind":"issue","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}