Authorization Flaw in HUIZHI ChargeOS Cloud Affects Wallet Balance Management
CVE-2026-111698

7.1HIGH

Key Information:

Vendor

Roinli

Status
Huizhi-chargeos-cloud
Vendor
CVE Published:
16 October 2026

What is CVE-2026-111698?

The HUIZHI ChargeOS cloud version 3.0.9 contains a critical missing authorization vulnerability in the hcp-mp PayController.xcxRecharge endpoint. This flaw permits unauthorized users to alter any member's wallet balance without attempting any payment. By sending crafted requests with specific parameters such as userId and arbitrary amounts, attackers can improperly credit or debit wallet balances, leading to exploitation and unauthorized usage of charging services at no cost. This vulnerability raises significant concerns regarding user data security and trust within the platform.

Affected Version(s)

HUIZHI-ChargeOS-cloud 0 <= 3.0.9

References

https://hackmd.io/@hieuPenguinnn/huizhi-chargeos-mp-membe...
third-party-advisory
https://github.com/roinli/HUIZHI-ChargeOS-cloud/blob/1a2c...
technical-description
https://www.vulncheck.com/advisories/huizhi-chargeos-clou...
third-party-advisory

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

hieuPenguinnn
.