---
id: CVE-2026-111611
title: >-
  roncoo-education through 25.0.0-RELEASE contains an insecure direct object
  reference vulnerability that allows authenticated users to cancel or continue
  payment on other users' orders
summary: >-
  roncoo-education through 25.0.0-RELEASE contains an insecure direct object
  reference vulnerability that allows authenticated users to cancel or continue
  payment on other users' orders. Attackers can supply another user's order
  number to …
severity: medium
cvss: 5.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N'
cwe:
  - CWE-639
vendor: roncoo
product: roncoo-education
affected:
  - roncoo-education <= 25.0.0-RELEASE
published: '2026-10-16'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T22:17:20.853'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-111611'
references:
  - url: 'https://github.com/roncoo/roncoo-education'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/roncoo/roncoo-education/blob/v25.0.0-RELEASE/roncoo-education-service/roncoo-education-service-user/src/main/java/com/roncoo/education/user/service/auth/biz/AuthOrderPayBiz.java#L131-L231
    label: disclosure@vulncheck.com
  - url: >-
      https://hackmd.io/@hieuPenguinnn/roncoo-education-auth-order-cancel-continue-missing-ownership-idor
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/roncoo-education-through-25.0.0-release-idor-via-order-pay-cancel-and-continue-endpoints
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
epss: 0.00223
epssPercentile: 0.1281
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-16T19:33:53.622701Z'
ingestedAt: '2026-10-16T18:43:08.696Z'
---

## Overview

roncoo-education through 25.0.0-RELEASE contains an insecure direct object reference vulnerability that allows authenticated users to cancel or continue payment on other users' orders. Attackers can supply another user's order number to the pay cancel or continue endpoints to close pending orders or read course ids and prices.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.