Live › vulnerability › CVE-2026-111698
Go to dashboardHUIZHI ChargeOS cloud (roinli/HUIZHI-ChargeOS-cloud, up to 3.0.9 / commit 1a2cbab) has a missing authorization flaw in the hcp-mp GET /pay/xcxRecharge endpoint. It takes amount and userId from the request instead of the authenticated session, so any logged-in member can add to their own or another member's wallet balance without paying. The same pattern (client-supplied userId) also exposes other members' balances, credit, profile and orders (CVE-2026-111697).
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Operators running HUIZHI ChargeOS cloud up to version 3.0.9 with the hcp-mp mini-program payment endpoint exposed. Sources do not say which deployments expose that endpoint publicly or whether a vendor patch exists.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| HUIZHI-ChargeOS-cloud | github | <= 3.0.9 | – |
3.0.9Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
HUIZHI ChargeOS cloud through 3.0.9 contains a missing authorization vulnerability in the hcp-mp PayController.xcxRecharge endpoint that allows attackers to modify any member's wallet balance without payment. Attackers can send requests with arbitrary amount and userId parameters to credit or reduce balances and consume charging services for free.
This page as .md · .json · in your agent: get_signal("CVE-2026-111698")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.