CVE-2026-111611

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-111611
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-111611.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-111611
Published
2026-10-16T17:38:51Z
Modified
2026-10-21T02:50:18Z
Severity
  • 5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
roncoo-education through 25.0.0-RELEASE IDOR via Order Pay Cancel and Continue Endpoints
Details

roncoo-education through 25.0.0-RELEASE contains an insecure direct object reference vulnerability that allows authenticated users to cancel or continue payment on other users' orders. Attackers can supply another user's order number to the pay cancel or continue endpoints to close pending orders or read course ids and prices.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-639"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111611.json"
}
References

Affected packages

Git / github.com/roncoo/roncoo-education

Affected ranges

Type
GIT
Repo
https://github.com/roncoo/roncoo-education
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last Affected
5a482759fc3644fa24310beac55954b6f59b523a
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "last_affected":  "25.0.0-RELEASE"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        }
    ]
}

Affected versions

v25.*
v25.0.0-RELEASE

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-111611.json"