---
id: CVE-2026-111698
title: >-
  HUIZHI ChargeOS cloud through 3.0.9 contains a missing authorization
  vulnerability in the hcp-mp PayController.xcxRecharge endpoint that allows
  attackers to modify any member's wallet balance without payment
summary: >-
  HUIZHI ChargeOS cloud through 3.0.9 contains a missing authorization
  vulnerability in the hcp-mp PayController.xcxRecharge endpoint that allows
  attackers to modify any member's wallet balance without payment. Attackers can
  send requests …
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N'
cwe:
  - CWE-639
vendor: roinli
product: HUIZHI-ChargeOS-cloud
affected:
  - HUIZHI-ChargeOS-cloud <= 3.0.9
published: '2026-10-16'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T20:17:22.610'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-111698'
references:
  - url: >-
      https://github.com/roinli/HUIZHI-ChargeOS-cloud/blob/1a2cbab79bb7abe7df3b4f9977f5d0e18e65bd4a/hcp-modules/hcp-mp/src/main/java/com/hcp/mp/controller/PayController.java#L18-L28
    label: disclosure@vulncheck.com
  - url: 'https://hackmd.io/@hieuPenguinnn/huizhi-chargeos-mp-member-api-userid-idor'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/huizhi-chargeos-cloud-through-3.0.9-unpaid-wallet-credit-via-pay-xcxrecharge
    label: disclosure@vulncheck.com
  - url: 'https://hackmd.io/@hieuPenguinnn/huizhi-chargeos-mp-member-api-userid-idor'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - cve.org
  - exploit-available
epss: 0.00326
epssPercentile: 0.25487
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-16T19:40:45.690884Z'
ingestedAt: '2026-10-16T18:43:08.655Z'
---

## Overview

HUIZHI ChargeOS cloud through 3.0.9 contains a missing authorization vulnerability in the hcp-mp PayController.xcxRecharge endpoint that allows attackers to modify any member's wallet balance without payment. Attackers can send requests with arbitrary amount and userId parameters to credit or reduce balances and consume charging services for free.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.