{"id":"CVE-2026-111719","kind":"vulnerability","aliases":["CVE-2026-111719"],"related":[],"title":"Roncoo-pay: unauthenticated payment record lookup by guessable transaction number","description":"Roncoo-pay through commit 9428382 contains a missing authorization vulnerability in F2FPayController.orderQuery that allows unauthenticated attackers to retrieve payment records by supplying a trxNo parameter. Attackers can guess transaction numbers, a '7' prefix plus a snowflake ID, to obtain the full serialized payment record of any merchant.","summary":"Roncoo-pay's F2FPayController.orderQuery endpoint lacks an authorization check, so anyone can request a payment record by supplying a trxNo value. Transaction numbers follow a predictable pattern (a '7' prefix plus a snowflake ID), so an attacker can guess them and read the full payment record of any merchant.","severity":"high","cvss":8.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["java","package","payments","roncoo-pay"],"not_affected_if":[],"how_to_check":"- unknown","fix":"- unknown","status":"open","published_at":"2026-10-16T18:17:56+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","triaged_at":"2026-10-25T03:04:25+00:00","updated_at":"2026-10-25T03:04:25+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:04:25Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"internet","title":"Roncoo-pay: unauthenticated payment record lookup by guessable transaction number","impact":"medium","summary":"Roncoo-pay's F2FPayController.orderQuery endpoint lacks an authorization check, so anyone can request a payment record by supplying a trxNo value. Transaction numbers follow a predictable pattern (a '7' prefix plus a snowflake ID), so an attacker can guess them and read the full payment record of any merchant.","category":"package","nicknames":[],"who_cares":["roncoo-pay","payments","java"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker reads any merchant's full payment records by guessing transaction numbers","analyst_note":"Check the NVD entry and the Roncoo-pay repository for a fixed commit or release, and confirm which deployments expose the F2FPayController orderQuery endpoint.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000536,"input_tokens":3347,"output_tokens":403,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-111719':14A,17A '-2026':13A,16A '7':53B,106C '9428382':79C 'allow':88C 'anyon':35B 'attack':61B,90C,100C 'author':32B,83C 'check':33B 'commit':78C 'contain':80C 'cve':12A,15A 'endpoint':29B 'f2fpaycontroller.orderquery':28B,86C 'follow':48B 'full':68B,115C 'guess':63B,102C 'guessabl':9A 'id':58B,111C 'java':18B 'lack':30B 'lookup':7A 'merchant':73B,121C 'miss':82C 'number':11A,47B,104C 'obtain':113C 'packag':19B 'paramet':99C 'pattern':51B 'pay':3A,23B,26B,76C 'payment':5A,20B,39B,69B,93C,117C 'plus':55B,108C 'predict':50B 'prefix':54B,107C 'read':66B 'record':6A,40B,70B,94C,118C 'request':37B 'retriev':92C 'roncoo':2A,22B,25B,75C 'roncoo-pay':1A,21B,24B,74C 'serial':116C 'snowflak':57B,110C 'suppli':42B,96C 'transact':10A,46B,103C 'trxno':44B,98C 'unauthent':4A,89C 'valu':45B 'vulner':84C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T18:17:56+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111719","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111719","severity":null,"published_at":"2026-10-16T18:17:56+00:00","modified_at":"2026-10-21T22:16:47+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}