CVE-2026-111719 Details

A missing authorization vulnerability has been identified in the Roncoo-Pay payment gateway, specifically in the F2FPayController's orderQuery method. This vulnerability allows unauthenticated attackers to access payment records by providing a transaction number (trxNo) parameter. The trxNo can be guessed, as it follows a predictable format: a '7' prefix followed by a snowflake ID. Exploiting this vulnerability enables attackers to retrieve the complete serialized payment record of any merchant on the platform.

To address this vulnerability, implement a merchant authentication check on the orderQuery route, similar to the existing checks on pay-initiation routes. After authenticating the merchant, enforce ownership by verifying that the requested payment record belongs to the caller before returning it. Additionally, consider registering an authentication interceptor on the gateway to prevent future unsigned query routes from being exposed by default.