CVE-2026-111698: HUIZHI ChargeOS cloud through 3.0.9 Unpaid Wallet Credit via /pay/xcxRecharge

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-16 · updated 2026-10-16
Weakness: CWE-639

Description

HUIZHI ChargeOS cloud through 3.0.9 contains a missing authorization vulnerability in the hcp-mp PayController.xcxRecharge endpoint that allows attackers to modify any member's wallet balance without payment. Attackers can send requests with arbitrary amount and userId parameters to credit or reduce balances and consume charging services for free.

Affected products

roinli HUIZHI-ChargeOS-cloud: through 3.0.9

References

https://github.com/roinli/HUIZHI-ChargeOS-cloud/blob/1a2cbab79bb7abe7df3b4f9977f5d0e18e65bd4a/hcp-modules/hcp-mp/src/main/java/com/hcp/mp/controller/PayController.java#L18-L28
https://hackmd.io/@hieuPenguinnn/huizhi-chargeos-mp-member-api-userid-idor
https://www.vulncheck.com/advisories/huizhi-chargeos-cloud-through-3.0.9-unpaid-wallet-credit-via-pay-xcxrecharge
https://hackmd.io/@hieuPenguinnn/huizhi-chargeos-mp-member-api-userid-idor

Get alerted when CVE-2026-111698 or the next vulnerability affects your stack