Is CVE-2026-111697 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-111697?

CVE-2026-111697 has a CVSS v3 severity of MEDIUM (6.5).

Back

CVE-2026-111697

Description

HUIZHI ChargeOS cloud through 3.0.9 contains an insecure direct object reference vulnerability in the hcp-mp MeController and OrderController that trusts client-supplied userId, openId and orderNumber parameters. Attackers can enumerate sequential member ids against endpoints like /me/getMemberBalanceByUserId and /order/orderDetail to read any member's wallet, credit, profile and charging orders.