Insecure Direct Object Reference in Course Tencent Cloud by Tencent

CVE-2026-129469

What is CVE-2026-129469?

Course Tencent Cloud before version 2.0.2 is susceptible to an insecure direct object reference vulnerability, which allows unauthenticated attackers to gain access to other users' refund previews. By manipulating the order serial number (sn) in API requests sent to /api/refund/confirm, attackers can retrieve sensitive data related to ordered items, including prices, refund amounts, and associated deadlines. This vulnerability can be exploited through the computation of valid sn values derived from Sqids-encoded order IDs, given the use of a default key, thereby increasing the risk of unauthorized access to user-related financial information.

References