Is CVE-2026-111698 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-111698?

CVE-2026-111698 has a CVSS v3 severity of MEDIUM (6.5).

Back

CVE-2026-111698

Description

HUIZHI ChargeOS cloud through 3.0.9 contains a missing authorization vulnerability in the hcp-mp PayController.xcxRecharge endpoint that allows attackers to modify any member's wallet balance without payment. Attackers can send requests with arbitrary amount and userId parameters to credit or reduce balances and consume charging services for free.