Missing Authorization Flaw in Roncoo-pay Payment Records

CVE-2026-111719

What is CVE-2026-111719?

Roncoo-pay has a vulnerability due to a missing authorization check in the F2FPayController.orderQuery function. This flaw permits unauthenticated attackers to query payment records by simply providing a transaction number parameter. By exploiting this weakness, attackers who can guess the transaction numbers—specifically a '7' prefix followed by a snowflake ID—gain unauthorized access to serialized payment records from any merchant, potentially compromising sensitive transaction information.

References