CVE-2026-111697: HUIZHI ChargeOS cloud through 3.0.9 IDOR via hcp-mp Member and Order APIs
HUIZHI ChargeOS cloud through 3.0.9 contains an insecure direct object reference vulnerability in the hcp-mp MeController and OrderController that trusts client-supplied userId, openId and orderNumber parameters. Attackers can enumerate sequential member ids against endpoints like /me/getMemberBalanceByUserId and /order/orderDetail to read any member's wallet, credit, profile and charging orders.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs network access to the affected hcp-mp API endpoints and low-privileged access, as indicated by the required privileges rating. No user interaction is required.
What information could be exposed?
An attacker can enumerate sequential member IDs or supply other users' identifiers to retrieve member wallet balances, credit information, profiles, and charging-order details. The reported impact is limited to confidentiality; integrity and availability are not affected.
Which API inputs and endpoints should be reviewed?
Review hcp-mp MeController and OrderController endpoints that accept client-supplied userId, openId, or orderNumber values. Examples identified in the report include /me/getMemberBalanceByUserId and /order/orderDetail.
How can teams assess whether they are affected?
Determine whether the deployment is HUIZHI ChargeOS cloud through version 3.0.9 and test whether an authenticated low-privileged account can retrieve another member's data by changing userId, openId, or orderNumber parameters. Sequential member-ID enumeration is specifically reported as viable.