COURSE-TENCENT-CLOUD · CVE-2026-129469 · Other
NO FIX YET · SEE WHAT TO DO
Course-tencent-cloud before 2.0.2 exposes refund previews through /api/refund/confirm, which accepts an order sn without checking ownership. Because order sn values can be computed from sequential ids using the default Sqids key, an unauthenticated attacker can read other users' ordered items, prices, refund amounts, fees and deadlines.
first public Nov 15, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams running course-tencent-cloud before 2.0.2 with the refund confirm endpoint reachable from the internet. The sources say order sn values are derived from sequential ids with the default Sqids key, so keeping a custom key may reduce exposure, but they do not say that it removes it. Deployments on a fixed version can skip it.
Not affected if fixed-version
Who cares course-tencent-cloud, self-hosted, tencent-cloud
2.0.2/api/refund/confirm route in the deployed application2.0.2 or laterCourse-tencent-cloud before 2.0.2 contains an insecure direct object reference vulnerability that allows unauthenticated attackers to view other users' refund previews by supplying an order sn to /api/refund/confirm. Attackers can compute valid sn values from Sqids-encoded sequential order ids using the default key to disclose ordered items, prices, refund amounts, fees and deadlines.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.