CVE-2026-111697

HUIZHI ChargeOS cloud through 3.0.9 contains an insecure direct object reference vulnerability in the hcp-mp MeController and OrderController that trusts client-supplied userId, openId and orderNumber parameters. Attackers can enumerate sequential member ids against endpoints like /me/getMemberBalanceByUserId and /order/orderDetail to read any member's wallet, credit, profile and charging orders.

The vulnerability allows unauthorized access to all members' personal and financial data, potentially leading to privacy breaches and identity theft. The organization may face reputational and legal damage.

Update ChargeOS to a version later than 3.0.9 or apply the vendor patch. It is also recommended to implement session-based access control instead of trusting client-supplied parameters.