CVE-2026-111719
Roncoo-pay through commit 9428382 contains a missing authorization vulnerability in F2FPayController.orderQuery that allows unauthenticated
CVSS
5.9
Medium
EPSS
—
KEV
—
Exploit Today
—
0-100
Published: Oct 16, 2026 · Last modified: Oct 16, 2026 · CWE-306
Not enough EPSS history yet.
Roncoo-pay through commit 9428382 contains a missing authorization vulnerability in F2FPayController.orderQuery that allows unauthenticated attackers to retrieve payment records by supplying a trxNo parameter. Attackers can guess transaction numbers, a '7' prefix plus a snowflake ID, to obtain the full serialized payment record of any merchant.
- github.comhttps://github.com/roncoo/roncoo-pay/blob/9428382af21cd5568319eae7429b7e1d0332ff40/roncoo-pay-web-gateway/src/main/java/com/roncoo/pay/controller/F2FPayController.java#L75-L79
- hackmd.iohttps://hackmd.io/@hieuPenguinnn/roncoo-pay-f2f-order-query-unauth-record-disclosure
- www.vulncheck.comhttps://www.vulncheck.com/advisories/roncoo-pay-through-commit-9428382-information-disclosure-via-f2fpay-order-query
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-1117067.5 HIG—
———99AI through 4.3.0 contains a missing authentication vulnerability in the POST /api/chatLog/exportExcel route that allows unauthenticated attackers to export all users' chat logs. Attackers can send requests with controlled page, size, and optional email fields to download xlsx files containing usernames, emails, prompts, and AI answers.7hCVE-2026-1117049.8 CRI—
———LangChat through commit 2a6285a contains a missing authentication vulnerability that allows unauthenticated remote attackers to access REST controllers because no Sa-Token interceptor is registered. Attackers can query /api/v1/auth/users to read plaintext passwords, retrieve LLM provider API keys, create super-admin accounts, and modify or delete data.7hCVE-2026-1117017.0 HIG—
———OtterMind Nubase through 0.1.4 contains a missing authentication vulnerability that allows unauthenticated attackers to access private bucket objects because /storage/v1/object/{bucketId}/{path} is treated as public for every HTTP method. Attackers knowing a tenant subdomain, bucket id and object path can download objects from private buckets and delete stored objects without an apikey or JWT.7hCVE-2026-1116994.8 MED—
———Niefy wx-api through 0.8.2 contains an authentication bypass vulnerability that allows unauthenticated attackers to impersonate WeChat fans by supplying a raw openid cookie to fan-facing controllers. Attackers knowing a victim's openid can call /wxUser/getUserInfo and /wxUserTags endpoints to read nickname, phone, unionid and tags, and add or remove fan tags.7hCVE-2026-1116945.3 MED—
———qKnow through 2.4.3 contains a missing authentication vulnerability that allows unauthenticated remote attackers to access /flyflow workflow integration endpoints permitted in SecurityConfig. Attackers can POST sequential userId values to /flyflow/userById or call roleAll and deptListByParentDeptId to enumerate user phone numbers, roles, and department structure.7hCVE-2026-1116739.8 CRI—
———IceCMS through 4.1.5 contains a missing authentication vulnerability that allows unauthenticated attackers to modify, delete, or disable any account because /User/** is excluded from the Shiro jwt filter. Attackers can send PUT requests to /User/updateUser to set a new password and role on any userId, including administrators, enabling full account takeover.7h