{"id":"CVE-2026-111698","kind":"vulnerability","aliases":["CVE-2026-111698"],"related":[],"title":"HUIZHI ChargeOS cloud: missing authorization lets attackers alter member wallet balances","description":"HUIZHI ChargeOS cloud through 3.0.9 contains a missing authorization vulnerability in the hcp-mp PayController.xcxRecharge endpoint that allows attackers to modify any member's wallet balance without payment. Attackers can send requests with arbitrary amount and userId parameters to credit or reduce balances and consume charging services for free.","summary":"HUIZHI ChargeOS cloud (roinli/HUIZHI-ChargeOS-cloud, up to 3.0.9 / commit 1a2cbab) has a missing authorization flaw in the hcp-mp GET /pay/xcxRecharge endpoint. It takes amount and userId from the request instead of the authenticated session, so any logged-in member can add to their own or another member's wallet balance without paying. The same pattern (client-supplied userId) also exposes other members' balances, credit, profile and orders (CVE-2026-111697).","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"HUIZHI-ChargeOS-cloud","fixed":[],"affected":"<= 3.0.9","ecosystem":"github"}],"ecosystems":[],"tags":["authenticated","ev-charging","huizhi-chargeos","idor","other","self-hosted","spring-cloud"],"not_affected_if":["auth-required","managed-hosting","unknown"],"how_to_check":"Check whether you run HUIZHI-ChargeOS-cloud at or before 3.0.9. In hcp-modules/hcp-mp/src/main/java/com/hcp/mp/controller/PayController.java, if xcxRecharge still has @RequestParam(\"userId\") and the SecurityUtils.getUserId() line commented out, you are exposed. Review gateway/access logs for GET /pay/xcxRecharge with unexpected amount values or userId different from the caller, and audit member wallet balances against payment records.","fix":"No fixed version known; no vendor advisory or patch found. Workaround: patch PayController to use SecurityUtils.getUserId() instead of the request userId, and credit balances only after a verified payment callback; apply the same to MeController/OrderController.","status":"open","published_at":"2026-10-16T18:17:53+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","triaged_at":"2026-10-25T03:36:26+00:00","updated_at":"2026-10-25T03:44:37+00:00","category":"other","confidence":0.75,"triage":{"at":"2026-10-25T03:36:26Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"HUIZHI ChargeOS cloud: missing authorization lets attackers alter member wallet balances","impact":"medium","summary":"HUIZHI ChargeOS cloud through 3.0.9 has a missing authorization check on the hcp-mp PayController.xcxRecharge endpoint. An attacker can send arbitrary amount and userId values to credit or debit any member's wallet without paying.","category":"other","nicknames":[],"who_cares":["huizhi-chargeos","ev-charging","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker credits or drains member wallets and gets charging services free.","analyst_note":"Confirm the fixed version and vendor advisory from the NVD entry and HUIZHI; check whether xcxRecharge requires any login token.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Operators running HUIZHI ChargeOS cloud up to version 3.0.9 with the hcp-mp mini-program payment endpoint exposed. Sources do not say which deployments expose that endpoint publicly or whether a vendor patch exists.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000567,"input_tokens":3344,"output_tokens":466,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed version and vendor advisory from the NVD entry and HUIZHI; check whether xcxRecharge requires any login token.","search":"'-111697':109B '-111698':14A,17A '-2026':13A,16A,108B '/pay/xcxrecharge':57B '1a2cbab':45B '3.0.9':43B,114C 'add':79B 'allow':128C 'also':98B 'alter':8A 'amount':61B,145C 'anoth':84B 'arbitrari':144C 'attack':7A,129C,139C 'authent':22B,70B 'author':5A,49B,118C 'balanc':11A,88B,102B,136C,153C 'charg':25B,156C 'chargeo':2A,28B,38B,111C 'chargeos':20A 'client':95B 'client-suppli':94B 'cloud':3A,21A,36B,39B,112C 'commit':44B 'consum':155C 'contain':115C 'credit':103B,150C 'cve':12A,15A,107B 'endpoint':58B,126C 'ev':24B 'ev-charg':23B 'expos':99B 'flaw':50B 'free':159C 'get':56B 'hcp':54B,123C 'hcp-mp':53B,122C 'host':33B 'huizhi':1A,19A,27B,37B,110C 'huizhi-chargeo':26B 'huizhi-chargeos-cloud':18A 'idor':29B 'instead':67B 'let':6A 'log':75B 'logged-in':74B 'member':9A,77B,85B,101B,133C 'miss':4A,48B,117C 'modifi':131C 'mp':55B,124C 'order':106B 'paramet':148C 'pattern':93B 'pay':90B 'paycontroller.xcxrecharge':125C 'payment':138C 'profil':104B 'reduc':152C 'request':66B,142C 'roinli/huizhi-chargeos-cloud':40B 'self':32B 'self-host':31B 'send':141C 'servic':157C 'session':71B 'spring':35B 'spring-cloud':34B 'suppli':96B 'take':60B 'userid':63B,97B,147C 'vulner':119C 'wallet':10A,87B,135C 'without':89B,137C","nicknames":[],"mitigations":[],"who_affected":"Operators running HUIZHI ChargeOS cloud up to version 3.0.9 with the hcp-mp mini-program payment endpoint exposed. Sources do not say which deployments expose that endpoint publicly or whether a vendor patch exists.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T18:17:53+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111698","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111698","severity":null,"published_at":"2026-10-16T18:17:53+00:00","modified_at":"2026-10-16T20:17:22+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-111698:784","url":null,"severity":null,"published_at":"2026-10-25T03:44:37+00:00","modified_at":"2026-10-25T03:44:37+00:00","first_seen_at":"2026-10-25T03:44:37+00:00","fetched_at":"2026-10-25T03:44:37+00:00","note":"Read researcher writeup (hackmd) and pinned source: xcxRecharge takes amount+userId from query, SecurityUtils.getUserId() commented out; gateway requires a valid member JWT (so any logged-in member, not anonymous; whitelist not checked). No vendor advisory or fixed release found; repo has no release tags, README says 3.0.8. Writeup was source-reading only, not executed; no exploitation seen."}],"documents":[{"id":3311,"url":"https://hackmd.io/@hieuPenguinnn/huizhi-chargeos-mp-member-api-userid-idor","title":"hieuPenguinnn: HUIZHI-ChargeOS-cloud hcp-mp userId IDOR writeup (source review, not executed)","kind":"issue","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":3315,"url":"https://github.com/roinli/HUIZHI-ChargeOS-cloud/blob/1a2cbab79bb7abe7df3b4f9977f5d0e18e65bd4a/hcp-modules/hcp-mp/src/main/java/com/hcp/mp/controller/PayController.java","title":"PayController.java at 1a2cbab (xcxRecharge)","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":3317,"url":"https://www.vulncheck.com/advisories/huizhi-chargeos-cloud-through-3.0.9-unpaid-wallet-credit-via-pay-xcxrecharge","title":"VulnCheck advisory: HUIZHI ChargeOS cloud through 3.0.9 Unpaid Wallet Credit","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}