CVE-2026-129469: Medium severity vulnerability

Published Nov 15, 2026

Course-tencent-cloud before 2.0.2 contains an insecure direct object reference vulnerability that allows unauthenticated attackers to view other users' refund previews by supplying an order sn to /api/refund/confirm. Attackers can compute valid sn values from Sqids-encoded sequential order ids using the default key to disclose ordered items, prices, refund amounts, fees and deadlines.

Event History

Nov 15, 2026

CVE Published

via MITRE·12:48 PM

Data Sourced

via MITRE·12:48 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·01:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

Deployments of Course-tencent-cloud before 2.0.2 are affected if the refund confirmation endpoint is reachable. No authentication is required to retrieve another user's refund preview.

What does an attacker need to exploit it?

An attacker needs to submit a valid order sn value to /api/refund/confirm. Valid values can be computed from sequential order IDs because Sqids uses the default key.

What information can be disclosed?

The endpoint can reveal ordered items, prices, refund amounts, fees, and refund deadlines associated with other users' orders.

What should be done if patching cannot happen immediately?

Restrict access to /api/refund/confirm so unauthenticated users cannot reach it, and add ownership validation before returning refund-preview data. This reduces exposure until upgrading to 2.0.2 or later.

CVE-2026-129469: Medium severity vulnerability

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What information can be disclosed?

What should be done if patching cannot happen immediately?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What information can be disclosed?

What should be done if patching cannot happen immediately?