CVE-2026-111611: Authorization Bypass Through User-Controlled Key in roncoo roncoo-education

CVE-2026-111611 describes an authorization bypass vulnerability in roncoo-education through version 25.0.0-RELEASE. Authenticated users can exploit insecure direct object references by providing another user's order number to payment-related endpoints, enabling them to cancel or continue payments on orders they do not own. This also allows reading sensitive order details such as course IDs and prices. The vulnerability arises from insufficient access control checks on user-supplied keys in the payment workflow.

An attacker with valid authentication can interfere with other users' orders by canceling or continuing payments without authorization. This compromises order integrity and confidentiality of order details such as course identifiers and pricing information. There is no indication of privilege escalation beyond authenticated user level or system-wide compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to payment endpoints to only authorized users and monitor for suspicious activity involving order manipulation. Avoid sharing order numbers publicly and validate user ownership of orders in application logic.