---
id: "CVE-2026-111698"
kind: "vulnerability"
aliases: ["CVE-2026-111698"]
title: "HUIZHI ChargeOS cloud: missing authorization lets attackers alter member wallet balances"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "HUIZHI-ChargeOS-cloud", "fixed": [], "affected": "<= 3.0.9", "ecosystem": "github"}]
ecosystems: []
tags: ["authenticated", "ev-charging", "huizhi-chargeos", "idor", "other", "self-hosted", "spring-cloud"]
not_affected_if: ["auth-required", "managed-hosting", "unknown"]
published_at: "2026-10-16T18:17:53+00:00"
first_seen_at: "2026-10-23T21:57:13+00:00"
updated_at: "2026-10-25T03:44:37+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111698", "first_seen_at": "2026-10-23T21:57:13+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-25T03:44:37+00:00"}]
---

# HUIZHI ChargeOS cloud: missing authorization lets attackers alter member wallet balances

HUIZHI ChargeOS cloud (roinli/HUIZHI-ChargeOS-cloud, up to 3.0.9 / commit 1a2cbab) has a missing authorization flaw in the hcp-mp GET /pay/xcxRecharge endpoint. It takes amount and userId from the request instead of the authenticated session, so any logged-in member can add to their own or another member's wallet balance without paying. The same pattern (client-supplied userId) also exposes other members' balances, credit, profile and orders (CVE-2026-111697).

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- github:HUIZHI-ChargeOS-cloud affected <= 3.0.9 fixed ?

## How to check

Check whether you run HUIZHI-ChargeOS-cloud at or before 3.0.9. In hcp-modules/hcp-mp/src/main/java/com/hcp/mp/controller/PayController.java, if xcxRecharge still has @RequestParam("userId") and the SecurityUtils.getUserId() line commented out, you are exposed. Review gateway/access logs for GET /pay/xcxRecharge with unexpected amount values or userId different from the caller, and audit member wallet balances against payment records.

## Fix

No fixed version known; no vendor advisory or patch found. Workaround: patch PayController to use SecurityUtils.getUserId() instead of the request userId, and credit balances only after a verified payment callback; apply the same to MeController/OrderController.

## Timeline

- 2026-10-23T21:57:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111698
- 2026-10-25T03:44:37+00:00 analyst — Read researcher writeup (hackmd) and pinned source: xcxRecharge takes amount+userId from query, SecurityUtils.getUserId() commented out; gateway requires a valid member JWT (so any logged-in member, not anonymous; whitelist not checked). No vendor advisory or fixed release found; repo has no release tags, README says 3.0.8. Writeup was source-reading only, not executed; no exploitation seen.

## Documents

- [advisory] hieuPenguinnn: HUIZHI-ChargeOS-cloud hcp-mp userId IDOR writeup (source review, not executed) https://hackmd.io/@hieuPenguinnn/huizhi-chargeos-mp-member-api-userid-idor
- [advisory] VulnCheck advisory: HUIZHI ChargeOS cloud through 3.0.9 Unpaid Wallet Credit https://www.vulncheck.com/advisories/huizhi-chargeos-cloud-through-3.0.9-unpaid-wallet-credit-via-pay-xcxrecharge
- [describes] PayController.java at 1a2cbab (xcxRecharge) https://github.com/roinli/HUIZHI-ChargeOS-cloud/blob/1a2cbab79bb7abe7df3b4f9977f5d0e18e65bd4a/hcp-modules/hcp-mp/src/main/java/com/hcp/mp/controller/PayController.java

## From the sources

HUIZHI ChargeOS cloud through 3.0.9 contains a missing authorization vulnerability in the hcp-mp PayController.xcxRecharge endpoint that allows attackers to modify any member's wallet balance without payment. Attackers can send requests with arbitrary amount and userId parameters to credit or reduce balances and consume charging services for free.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_