---
id: CVE-2026-111611
title: >-
  roncoo-education through 25.0.0-RELEASE IDOR via Order Pay Cancel and Continue
  Endpoints
summary: >-
  roncoo-education through 25.0.0-RELEASE contains an insecure direct object
  reference vulnerability that allows authenticated users to cancel or continue
  payment on other users' orders. Attackers can supply another user's order
  number to …
severity: medium
cvss: 5.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-639
vendor: roncoo
product: roncoo-education
affected:
  - roncoo-education <= 25.0.0-RELEASE
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-16T19:33:53.622701Z'
published: '2026-10-16'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T21:19:45.346Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-111611'
references:
  - url: >-
      https://hackmd.io/@hieuPenguinnn/roncoo-education-auth-order-cancel-continue-missing-ownership-idor
  - url: >-
      https://github.com/roncoo/roncoo-education/blob/v25.0.0-RELEASE/roncoo-education-service/roncoo-education-service-user/src/main/java/com/roncoo/education/user/service/auth/biz/AuthOrderPayBiz.java#L131-L231
  - url: 'https://github.com/roncoo/roncoo-education'
  - url: >-
      https://www.vulncheck.com/advisories/roncoo-education-through-25.0.0-release-idor-via-order-pay-cancel-and-continue-endpoints
    label: >-
      VulnCheck Advisory: roncoo-education through 25.0.0-RELEASE IDOR via Order
      Pay Cancel and Continue Endpoints
tags:
  - cve.org
ingestedAt: '2026-10-16T18:43:08.696Z'
---

## Overview

roncoo-education through 25.0.0-RELEASE contains an insecure direct object reference vulnerability that allows authenticated users to cancel or continue payment on other users' orders. Attackers can supply another user's order number to the pay cancel or continue endpoints to close pending orders or read course ids and prices.

## Affected

- `roncoo-education <= 25.0.0-RELEASE`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.