CVE-2026-111611: roncoo-education through 25.0.0-RELEASE IDOR via Order Pay Cancel and Continue Endpoints
roncoo-education through 25.0.0-RELEASE contains an insecure direct object reference vulnerability that allows authenticated users to cancel or continue payment on other users' orders. Attackers can supply another user's order number to the pay cancel or continue endpoints to close pending orders or read course ids and prices.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated as a user of the affected application. They also need another user's order number to submit to the payment-cancel or payment-continue endpoints.
What is the impact of a successful exploit?
An authenticated attacker can cancel or continue payment processing for another user's order, including closing pending orders. The continue-payment functionality can also expose the affected order's course IDs and prices.
Are unauthenticated internet users affected?
The provided information describes exploitation by authenticated users, so unauthenticated access alone is not sufficient. The vulnerable endpoints are the order payment cancel and continue functions.
How can I determine whether an instance is potentially affected?
Instances running Roncoo-education through 25.0.0-RELEASE are potentially affected. A practical check is whether an authenticated low-privilege user can provide a different user's order number to the payment cancel or continue endpoints and receive order data or alter the order state.