{"id":"CVE-2026-111698","state":"PUBLISHED","title":"HUIZHI ChargeOS cloud through 3.0.9 Unpaid Wallet Credit via /pay/xcxRecharge","description":"HUIZHI ChargeOS cloud through 3.0.9 contains a missing authorization vulnerability in the hcp-mp PayController.xcxRecharge endpoint that allows attackers to modify any member's wallet balance without payment. Attackers can send requests with arbitrary amount and userId parameters to credit or reduce balances and consume charging services for free.","publishedAt":"2026-10-16T17:39:52.360Z","updatedAt":"2026-10-16T19:41:02.118Z","severity":{"score":7.1,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","source":"VulnCheck"},"assigner":"VulnCheck","products":["roinli HUIZHI-ChargeOS-cloud"],"affected":[{"vendor":"roinli","product":"HUIZHI-ChargeOS-cloud","packageURL":"pkg:github/roinli/HUIZHI-ChargeOS-cloud","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"3.0.9","versionType":"custom"}],"repo":"https://github.com/roinli/HUIZHI-ChargeOS-cloud"}],"references":["https://hackmd.io/@hieuPenguinnn/huizhi-chargeos-mp-member-api-userid-idor","https://github.com/roinli/HUIZHI-ChargeOS-cloud/blob/1a2cbab79bb7abe7df3b4f9977f5d0e18e65bd4a/hcp-modules/hcp-mp/src/main/java/com/hcp/mp/controller/PayController.java#L18-L28","https://www.vulncheck.com/advisories/huizhi-chargeos-cloud-through-3.0.9-unpaid-wallet-credit-via-pay-xcxrecharge"],"weaknesses":["CWE-639"],"ingestedAt":"2026-10-29T20:10:33.477Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/111xxx/CVE-2026-111698.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-111698","state":"PUBLISHED","datePublished":"2026-10-16T17:39:52.360Z","dateUpdated":"2026-10-16T19:41:02.118Z","assignerShortName":"VulnCheck","assignerOrgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateReserved":"2026-10-16T14:31:21.447Z"},"containers":{"cna":{"title":"HUIZHI ChargeOS cloud through 3.0.9 Unpaid Wallet Credit via /pay/xcxRecharge","descriptions":[{"lang":"en","value":"HUIZHI ChargeOS cloud through 3.0.9 contains a missing authorization vulnerability in the hcp-mp PayController.xcxRecharge endpoint that allows attackers to modify any member's wallet balance without payment. Attackers can send requests with arbitrary amount and userId parameters to credit or reduce balances and consume charging services for free."}],"affected":[{"vendor":"roinli","product":"HUIZHI-ChargeOS-cloud","packageURL":"pkg:github/roinli/HUIZHI-ChargeOS-cloud","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"3.0.9","versionType":"custom"}],"repo":"https://github.com/roinli/HUIZHI-ChargeOS-cloud"}],"references":[{"url":"https://hackmd.io/@hieuPenguinnn/huizhi-chargeos-mp-member-api-userid-idor","tags":["third-party-advisory"]},{"url":"https://github.com/roinli/HUIZHI-ChargeOS-cloud/blob/1a2cbab79bb7abe7df3b4f9977f5d0e18e65bd4a/hcp-modules/hcp-mp/src/main/java/com/hcp/mp/controller/PayController.java#L18-L28","tags":["technical-description"]},{"url":"https://www.vulncheck.com/advisories/huizhi-chargeos-cloud-through-3.0.9-unpaid-wallet-credit-via-pay-xcxrecharge","name":"VulnCheck Advisory: HUIZHI ChargeOS cloud through 3.0.9 Unpaid Wallet Credit via /pay/xcxRecharge","tags":["third-party-advisory"]}],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","baseScore":7.1,"baseSeverity":"HIGH"}},{"format":"CVSS","cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-639","lang":"en","description":"Authorization Bypass Through User-Controlled Key","type":"CWE"}]}],"providerMetadata":{"shortName":"VulnCheck","orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateUpdated":"2026-10-16T17:39:52.360Z"},"datePublic":"2026-10-15T00:00:00.000Z","credits":[{"lang":"en","value":"hieuPenguinnn","type":"finder"}],"x_generator":{"engine":"vulncheck-endgame"}},"adp":[{"title":"CISA ADP Vulnrichment","references":[{"url":"https://hackmd.io/@hieuPenguinnn/huizhi-chargeos-mp-member-api-userid-idor","tags":["exploit"]}],"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-10-16T19:40:45.690884Z","id":"CVE-2026-111698","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-16T19:41:02.118Z"}}]}}}