CVE-2026-111697: Authorization Bypass Through User-Controlled Key in roinli HUIZHI-ChargeOS-cloud

The HUIZHI ChargeOS cloud product up to version 3.0.9 contains an insecure direct object reference vulnerability in the hcp-mp MeController and OrderController components. These controllers improperly trust user-supplied parameters (userId, openId, orderNumber), enabling attackers to enumerate sequential member IDs through endpoints like /me/getMemberBalanceByUserId and /order/orderDetail. Exploiting this flaw allows unauthorized reading of any member's wallet, credit, profile, and charging order data, constituting an authorization bypass.

An attacker with low privileges can enumerate user identifiers and access sensitive personal and financial information of other members, including wallet balances, credit details, profiles, and charging orders. This compromises confidentiality and potentially privacy of all users in the affected system. The vulnerability does not require user interaction and has a high impact on data confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected endpoints and implement server-side validation to ensure that user-supplied identifiers correspond to the authenticated user. Monitor for unusual access patterns that may indicate exploitation attempts.