---
id: "CVE-2026-129469"
page: "https://infrastack.ai/live/CVE-2026-129469"
kind: "vulnerability"
aliases: ["CVE-2026-129469"]
title: "Course-tencent-cloud: unauthenticated users can view other users' refund previews"
severity: "medium"
cvss: 6.9
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "course-tencent-cloud", "fixed": [], "affected": "", "ecosystem": "npm"}]
ecosystems: ["npm"]
tags: ["course-tencent-cloud", "other", "self-hosted", "tencent-cloud"]
not_affected_if: ["fixed-version"]
published_at: "2026-11-15T13:17:00+00:00"
first_seen_at: "2026-11-15T13:36:04+00:00"
updated_at: "2026-11-15T13:36:20+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-129469", "first_seen_at": "2026-11-15T13:36:04+00:00"}]
exploit_sources: []
---

# Course-tencent-cloud: unauthenticated users can view other users' refund previews

Link for people: https://infrastack.ai/live/CVE-2026-129469 (this .md is for agents)

Course-tencent-cloud before 2.0.2 exposes refund previews through /api/refund/confirm, which accepts an order sn without checking ownership. Because order sn values can be computed from sequential ids using the default Sqids key, an unauthenticated attacker can read other users' ordered items, prices, refund amounts, fees and deadlines.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:course-tencent-cloud affected range not listed fixed no fixed version listed

## How to check

- Check the installed version of course-tencent-cloud and whether it is below `2.0.2`
- Look for the `/api/refund/confirm` route in the deployed application
- Check whether the Sqids key is still the default value

## Fix

- course-tencent-cloud: move to `2.0.2` or later

## Timeline

- 2026-11-15T13:36:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-129469

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/course-tencent-cloud-before-2.0.2-idor-via-api-refund-confirm
- [fix] Patch: github.com https://github.com/xiaochong0302/course-tencent-cloud/commit/8e8bcb4e13795006e16d51158790ce3120c8164a

## From the sources

Course-tencent-cloud before 2.0.2 contains an insecure direct object reference vulnerability that allows unauthenticated attackers to view other users' refund previews by supplying an order sn to /api/refund/confirm. Attackers can compute valid sn values from Sqids-encoded sequential order ids using the default key to disclose ordered items, prices, refund amounts, fees and deadlines.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_