CVE-2026-111611: roncoo-education through 25.0.0-RELEASE IDOR via Order Pay Cancel and Continue Endpoints

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-16 · updated 2026-10-16
Weakness: CWE-639

Description

roncoo-education through 25.0.0-RELEASE contains an insecure direct object reference vulnerability that allows authenticated users to cancel or continue payment on other users' orders. Attackers can supply another user's order number to the pay cancel or continue endpoints to close pending orders or read course ids and prices.

Affected products

roncoo-education: through 25.0.0-RELEASE

References

https://github.com/roncoo/roncoo-education
https://github.com/roncoo/roncoo-education/blob/v25.0.0-RELEASE/roncoo-education-service/roncoo-education-service-user/src/main/java/com/roncoo/education/user/service/auth/biz/AuthOrderPayBiz.java#L131-L231
https://hackmd.io/@hieuPenguinnn/roncoo-education-auth-order-cancel-continue-missing-ownership-idor
https://www.vulncheck.com/advisories/roncoo-education-through-25.0.0-release-idor-via-order-pay-cancel-and-continue-endpoints

Get alerted when CVE-2026-111611 or the next vulnerability affects your stack