CVE-2026-111719 Roncoo-pay through commit 9428382 Information Disclosure via /f2fPay/order/query
Unauthenticated attackers can retrieve full payment records by guessing transaction numbers in the Roncoo-pay library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-111719?
CVE-2026-111719 is a high-severity missing authorization vulnerability in roncoo-pay, published on 16 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Roncoo-pay through commit 9428382 contains a missing authorization vulnerability in F2FPayController.orderQuery that allows unauthenticated attackers to retrieve payment records by supplying a trxNo parameter. Attackers can guess transaction numbers, a '7' prefix plus a snowflake ID, to obtain the full serialized payment record of any merchant.
Weakness: CWE-306
Which versions are affected by CVE-2026-111719?
How do I fix CVE-2026-111719?
No fix has been published for CVE-2026-111719 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-111719 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-111719 exists.
Sources
Also known as GHSA-pxmf-cjhq-vjc3.