{"id":"CVE-2026-129469","kind":"vulnerability","aliases":["CVE-2026-129469"],"related":[],"title":"Course-tencent-cloud: unauthenticated users can view other users' refund previews","description":"Course-tencent-cloud before 2.0.2 contains an insecure direct object reference vulnerability that allows unauthenticated attackers to view other users' refund previews by supplying an order sn to /api/refund/confirm. Attackers can compute valid sn values from Sqids-encoded sequential order ids using the default key to disclose ordered items, prices, refund amounts, fees and deadlines.","summary":"Course-tencent-cloud before 2.0.2 exposes refund previews through /api/refund/confirm, which accepts an order sn without checking ownership. Because order sn values can be computed from sequential ids using the default Sqids key, an unauthenticated attacker can read other users' ordered items, prices, refund amounts, fees and deadlines.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"course-tencent-cloud","fixed":[],"affected":"","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["course-tencent-cloud","other","self-hosted","tencent-cloud"],"not_affected_if":["fixed-version"],"how_to_check":"- Check the installed version of course-tencent-cloud and whether it is below `2.0.2`\n- Look for the `/api/refund/confirm` route in the deployed application\n- Check whether the Sqids key is still the default value","fix":"- course-tencent-cloud: move to `2.0.2` or later","status":"open","published_at":"2026-11-15T13:17:00+00:00","first_seen_at":"2026-11-15T13:36:04+00:00","triaged_at":"2026-11-15T13:36:20+00:00","updated_at":"2026-11-15T13:36:20+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-11-15T13:36:20Z","model":"claude-haiku-5-5","output":{"fix":"- course-tencent-cloud: move to `2.0.2` or later","reach":"internet","title":"Course-tencent-cloud: unauthenticated users can view other users' refund previews","impact":"medium","summary":"Course-tencent-cloud before 2.0.2 exposes refund previews through /api/refund/confirm, which accepts an order sn without checking ownership. Because order sn values can be computed from sequential ids using the default Sqids key, an unauthenticated attacker can read other users' ordered items, prices, refund amounts, fees and deadlines.","audience":"businesses","category":"other","nicknames":[],"who_cares":["course-tencent-cloud","self-hosted","tencent-cloud"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"Attackers read other users' order, refund and pricing details","analyst_note":"","how_to_check":"- Check the installed version of course-tencent-cloud and whether it is below `2.0.2`\n- Look for the `/api/refund/confirm` route in the deployed application\n- Check whether the Sqids key is still the default value","plain_action":"","product_name":"course-tencent-cloud","needs_analyst":false,"not_affected_if":["fixed-version"],"who_is_affected":"Teams running course-tencent-cloud before 2.0.2 with the refund confirm endpoint reachable from the internet. The sources say order sn values are derived from sequential ids with the default Sqids key, so keeping a custom key may reduce exposure, but they do not say that it removes it. Deployments on a fixed version can skip it.","user_interaction":"no","product_ecosystem":"npm","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.00076,"input_tokens":4619,"output_tokens":596,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-129469':15A,18A '-2026':14A,17A '/api/refund/confirm':44B,112C '2.0.2':39B,88C 'accept':46B 'allow':97C 'amount':79B,136C 'attack':70B,99C,113C 'check':51B 'cloud':4A,22A,26B,33B,37B,86C 'comput':59B,115C 'contain':89C 'cours':2A,24B,35B,84C 'course':20A 'course-tencent-cloud':1A,19A,23B,34B,83C 'cve':13A,16A 'deadlin':82B,139C 'default':65B,128C 'direct':92C 'disclos':131C 'encod':122C 'expos':40B 'fee':80B,137C 'host':30B 'id':62B,125C 'insecur':91C 'item':76B,133C 'key':67B,129C 'object':93C 'order':48B,54B,75B,109C,124C,132C 'ownership':52B 'preview':12A,42B,105C 'price':77B,134C 'read':72B 'refer':94C 'refund':11A,41B,78B,104C,135C 'self':29B 'self-host':28B 'sequenti':61B,123C 'sn':49B,55B,110C,117C 'sqid':66B,121C 'sqids-encod':120C 'suppli':107C 'tencent':3A,21A,25B,32B,36B,85C 'tencent-cloud':31B 'unauthent':5A,69B,98C 'use':63B,126C 'user':6A,10A,74B,103C 'valid':116C 'valu':56B,118C 'view':8A,101C 'vulner':95C 'without':50B","nicknames":[],"mitigations":[],"who_affected":"Teams running course-tencent-cloud before 2.0.2 with the refund confirm endpoint reachable from the internet. The sources say order sn values are derived from sequential ids with the default Sqids key, so keeping a custom key may reduce exposure, but they do not say that it removes it. Deployments on a fixed version can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["coursetencentcloud"],"ptokens":["cloud","course","tencent"],"labels":["coursetencentcloud","medium","npm","other","selfhosted","tencentcloud"],"campaign_type":null,"search_a":"'-129469':15A,18A '-2026':14A,17A 'cloud':4A,22A 'cours':2A 'course':20A 'course-tencent-cloud':1A,19A 'cve':13A,16A 'preview':12A 'refund':11A 'tencent':3A,21A 'unauthent':5A 'user':6A,10A 'view':8A","search_b":"'/api/refund/confirm':44B '2.0.2':39B 'accept':46B 'amount':79B 'attack':70B 'check':51B 'cloud':26B,33B,37B 'comput':59B 'cours':24B,35B 'course-tencent-cloud':23B,34B 'deadlin':82B 'default':65B 'expos':40B 'fee':80B 'host':30B 'id':62B 'item':76B 'key':67B 'order':48B,54B,75B 'ownership':52B 'preview':42B 'price':77B 'read':72B 'refund':41B,78B 'self':29B 'self-host':28B 'sequenti':61B 'sn':49B,55B 'sqid':66B 'tencent':25B,32B,36B 'tencent-cloud':31B 'unauthent':69B 'use':63B 'user':74B 'valu':56B 'without':50B","search_c":"'/api/refund/confirm':112C '2.0.2':88C 'allow':97C 'amount':136C 'attack':99C,113C 'cloud':86C 'comput':115C 'contain':89C 'cours':84C 'course-tencent-cloud':83C 'deadlin':139C 'default':128C 'direct':92C 'disclos':131C 'encod':122C 'fee':137C 'id':125C 'insecur':91C 'item':133C 'key':129C 'object':93C 'order':109C,124C,132C 'preview':105C 'price':134C 'refer':94C 'refund':104C,135C 'sequenti':123C 'sn':110C,117C 'sqid':121C 'sqids-encod':120C 'suppli':107C 'tencent':85C 'unauthent':98C 'use':126C 'user':103C 'valid':116C 'valu':118C 'view':101C 'vulner':95C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-15T13:17:00+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-129469","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-129469","severity":null,"published_at":"2026-11-15T13:17:00+00:00","modified_at":"2026-11-15T13:17:00+00:00","first_seen_at":"2026-11-15T13:36:04+00:00","fetched_at":"2026-11-15T13:36:04+00:00","note":null}],"documents":[{"id":163539,"url":"https://github.com/xiaochong0302/course-tencent-cloud/commit/8e8bcb4e13795006e16d51158790ce3120c8164a","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":163540,"url":"https://www.vulncheck.com/advisories/course-tencent-cloud-before-2.0.2-idor-via-api-refund-confirm","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}