CVE-2026-111719: Roncoo-pay through commit 9428382 Information Disclosure via /f2fPay/order/query
Roncoo-pay through commit 9428382 contains a missing authorization vulnerability in F2FPayController.orderQuery that allows unauthenticated attackers to retrieve payment records by supplying a trxNo parameter. Attackers can guess transaction numbers, a '7' prefix plus a snowflake ID, to obtain the full serialized payment record of any merchant.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Roncoo-payto a version that resolves this vulnerability.Patch 9428382
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated remote attacker who can reach the /f2fPay/order/query endpoint can attempt exploitation. No account or user interaction is required.
What does an attacker need to retrieve payment records?
The attacker needs to supply a trxNo value. Transaction numbers can be guessed using the described pattern of a 7 prefix followed by a snowflake ID.
What information can be exposed?
Successful requests return the full serialized payment record for the targeted merchant transaction. The available data indicates confidentiality impact, with no integrity or availability impact described.
How can I determine whether my deployment is affected?
Deployments through commit 9428382 are identified as affected. Review the F2FPayController.orderQuery implementation and test whether /f2fPay/order/query returns payment records without authentication when given a trxNo parameter.