Medium severity6.5NVD Advisory· Published Oct 16, 2026· Updated Oct 16, 2026
CVE-2026-111698
CVE-2026-111698
Description
HUIZHI ChargeOS cloud through 3.0.9 contains a missing authorization vulnerability in the hcp-mp PayController.xcxRecharge endpoint that allows attackers to modify any member's wallet balance without payment. Attackers can send requests with arbitrary amount and userId parameters to credit or reduce balances and consume charging services for free.
Affected products
2- Range: <=3.0.9
- Range: <=3.0.9
Patches
Vulnerability mechanics
References
3- github.com/roinli/HUIZHI-ChargeOS-cloud/blob/1a2cbab79bb7abe7df3b4f9977f5d0e18e65bd4a/hcp-modules/hcp-mp/src/main/java/com/hcp/mp/controller/PayController.javanvd
- hackmd.io/@hieuPenguinnn/huizhi-chargeos-mp-member-api-userid-idornvd
- www.vulncheck.com/advisories/huizhi-chargeos-cloud-through-3.0.9-unpaid-wallet-credit-via-pay-xcxrechargenvd
News mentions
0No linked articles in our index yet.