---
id: CVE-2026-111719
title: >-
  Roncoo-pay through commit 9428382 Information Disclosure via
  /f2fPay/order/query
summary: >-
  Roncoo-pay through commit 9428382 contains a missing authorization
  vulnerability in F2FPayController.orderQuery that allows unauthenticated
  attackers to retrieve payment records by supplying a trxNo parameter.
  Attackers can guess transac…
severity: medium
cvss: 5.9
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-306
vendor: roncoo
product: roncoo-pay
affected:
  - roncoo-pay <= 9428382af21cd5568319eae7429b7e1d0332ff40
published: '2026-10-16'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T17:40:06.967Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-111719'
references:
  - url: >-
      https://hackmd.io/@hieuPenguinnn/roncoo-pay-f2f-order-query-unauth-record-disclosure
  - url: >-
      https://github.com/roncoo/roncoo-pay/blob/9428382af21cd5568319eae7429b7e1d0332ff40/roncoo-pay-web-gateway/src/main/java/com/roncoo/pay/controller/F2FPayController.java#L75-L79
  - url: >-
      https://www.vulncheck.com/advisories/roncoo-pay-through-commit-9428382-information-disclosure-via-f2fpay-order-query
    label: >-
      VulnCheck Advisory: Roncoo-pay through commit 9428382 Information
      Disclosure via /f2fPay/order/query
tags:
  - cve.org
ingestedAt: '2026-10-16T18:43:08.638Z'
---

## Overview

Roncoo-pay through commit 9428382 contains a missing authorization vulnerability in F2FPayController.orderQuery that allows unauthenticated attackers to retrieve payment records by supplying a trxNo parameter. Attackers can guess transaction numbers, a '7' prefix plus a snowflake ID, to obtain the full serialized payment record of any merchant.

## Affected

- `roncoo-pay <= 9428382af21cd5568319eae7429b7e1d0332ff40`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.