---
id: "CVE-2026-111697"
kind: "vulnerability"
aliases: ["CVE-2026-111697"]
title: "HUIZHI ChargeOS cloud: member wallet and order data readable by changing IDs"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "HUIZHI-ChargeOS-cloud", "fixed": [], "affected": "<= 3.0.9", "ecosystem": "vendor"}]
ecosystems: []
tags: ["auth-required", "ev-charging", "hcp-mp", "hucizhi-chargeos", "huizhi-chargeos", "idor", "self-hosted", "spring-cloud", "vendor"]
not_affected_if: ["hcp-mp-not-exposed", "patched-release"]
published_at: "2026-10-16T18:17:53+00:00"
first_seen_at: "2026-10-23T21:57:13+00:00"
updated_at: "2026-10-25T03:45:44+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111697", "first_seen_at": "2026-10-23T21:57:13+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-25T03:45:44+00:00"}]
---

# HUIZHI ChargeOS cloud: member wallet and order data readable by changing IDs

HUIZHI ChargeOS cloud through 3.0.9 trusts client-supplied userId, openId and orderNumber values in its hcp-mp controllers without checking ownership. An attacker can enumerate sequential member IDs to read any member's wallet balance, credit, profile and charging orders.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:HUIZHI-ChargeOS-cloud affected <= 3.0.9 fixed ?

## How to check

Check whether you run HUIZHI-ChargeOS-cloud at or before 3.0.9 (master commit 1a2cbab or earlier). In hcp-modules/hcp-mp/.../MeController.java and OrderController.java, look for @RequestParam("userId") with the SecurityUtils.getUserId() line commented out. Then, logged in as one member, call GET /me/getMemberBalanceByUserId?userId=<another member id>; data returned means exposed.

## Fix

No fixed release known. No release tag and no vendor advisory; latest master (commit 1a2cbab, V3.0.9) is vulnerable. Interim: patch hcp-mp controllers (MeController, OrderController, PayController) to use SecurityUtils.getUserId() instead of request userId/openId, and scope orderDetail by owner.

## Timeline

- 2026-10-23T21:57:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111697
- 2026-10-25T03:45:44+00:00 analyst — No fixed version exists: no release tags, latest master commit 1a2cbab (V3.0.9, 2026-04-30) is the vulnerable one; vendor has no advisory. Endpoints DO require login: gateway AuthFilter checks JWT plus Redis session, so attacker needs any member account (matches PR:L). Read from VulnCheck advisory, researcher writeup (source review only, not executed) and MeController source. Not marking anything verified (no vendor words).

## Documents

- [advisory] VulnCheck: HUIZHI ChargeOS cloud through 3.0.9 IDOR https://www.vulncheck.com/advisories/huizhi-chargeos-cloud-through-3.0.9-idor-via-hcp-mp-member-and-order-apis
- [describes] hieuPenguinnn: HUIZHI-ChargeOS-cloud hcp-mp userId IDOR writeup (source review, not executed) https://hackmd.io/@hieuPenguinnn/huizhi-chargeos-mp-member-api-userid-idor

## From the sources

HUIZHI ChargeOS cloud through 3.0.9 contains an insecure direct object reference vulnerability in the hcp-mp MeController and OrderController that trusts client-supplied userId, openId and orderNumber parameters. Attackers can enumerate sequential member ids against endpoints like /me/getMemberBalanceByUserId and /order/orderDetail to read any member's wallet, credit, profile and charging orders.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_