CVE-2026-111719
Summary
by MITRE • 10/16/2026
Roncoo-pay through commit 9428382 contains a missing authorization vulnerability in F2FPayController.orderQuery that allows unauthenticated attackers to retrieve payment records by supplying a trxNo parameter. Attackers can guess transaction numbers, a '7' prefix plus a snowflake ID, to obtain the full serialized payment record of any merchant.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/16/2026
Xxx Xxxxxx-xxx Xxxxxxxxx, Xxxxxxxxxxxx Xx Xxxxxxx Xxxxxx Xxxxxxx, Xxxxxxx Xxxx X Xxxxxxxx Xxxxxxx Xxxxxxxxxxxxx Xxxxxxxxxxxxx Xxxxxx Xxx Xxxxxxxxxxxxxxxx.xxxxxxxxxx Xxxxxxxx. Xxxx Xxxx Xxxxx Xxxx Xx Xxxxxxxxxxxx Xxxxxx Xxxxxxx Xxxxxxxxx Xxxx Xxxxx Xx Xxxxxx Xxxxxxx Xxx Xxxxxxxxxx Xxxx Xxx Xxxxxxxxxx Xxxxxxxxxx Xx Xxxx Xxxxxxxx Xxxxxxx Xxxxxxxxxxx Xxxxxxx. Xxxxxxxxxxxx, Xxx Xxxxxxxxxxxxxxx Xxxxxxxx Xxx Xxxxxxxx Xxxx Xxxx Xxx Xxxxxxxx Xxxxxxx Xxxxxxxxx Xxxxx Xxxxxxx Xxxxxx Xx Xxxxxxxxxxxxxx Xxxxxxxxxxx. Xxx Xxxx Xxxxxxxxx Xxxxxxxxxx Xxxx Xx Xxx Xxxxxxxxxx'x Xxxxx, Xxxxx Xxxxxxxxx Xxxxxxxx Xxxxxxxx Xxxxx Xxxxxx Xx Xxx Xxxxxxxx Xx X Xxxxx Xxxxxxxxx Xxxxxx Xxxx Xxxxxxxxxx Xxx Xxxxxxxxx'x Xxxxxxxx Xxxxxxx Xxx Xxxxxxxx Xxxxxxxxxx Xxxx Xxxx Xxxxxxxxxxx Xx. Xxxx Xxxxxx Xxxxxxxxx Xxxxxxxxxxx Xxxxx X Xxxxxxxxx Xxxxxxxxxxxxxx Xxxxxxxx Xxxx X Xxxxxxxx Xxxxxxxxxx Xxxx Xxxxxxxxx Xxxx Xxx Xxxxxx Xxx Xxx Xxxxxxxxx Xx Xxxxx Xxxxx Xxxxxxxxxxx.
Xxx Xxxxxxxxxxx Xxxxxx Xx Xxxx Xxxxxxxxxxxxx Xx Xxxxxx, Xx Xx Xxxxxx Xxxxxxxxx Xx Xxxxxxxx Xxxx Xxxxxxxxxx Xxxxxxx Xxxxxxx Xxxxxxxxx Xx Xxx Xxxxxxxx Xxxxxxxxxx Xxxx Xxx Xxxxxx-xxx Xxxxxx. Xxx Xxxxxxxx Xxxxxxxx Xxxx Xx Xxxxxxxxx X Xxxxx Xxxxxxxxx Xxxx Xxxxxxxxxxx Xx Xx Xxxxxxxx Xxxxxxxxxxx. Xxxxxxx Xxx Xxxxxxxxxx Xxxxxxxx Xxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx Xxxxxxxxxx Xxxxxxx, Xxxxxxxxxxxx Xxxxx Xxxxxxxxx X 'x' Xxxxxx Xxxxxxxx Xx X Xxxxxxxxx Xx Xxxxxxxxx, Xxxxx Xxxxxxxxxxx Xxx Xxxxxxxxxxx Xx Xxxxx-xxxxx Xxxxxxxx Xx Xxxxxxxxxx Xxxxxxxxxxx. Xxxxxxxxx Xxx Xxx Xxxxxxxx Xx Xx Xxxxxx Xxx Xxxx-xxxxxxx Xxx Xxxxx Xxxx Xxxxxxxxxx Xxxxxxxxxx Xx Xxxxx Xxxxx Xxxx Xxxx Xxxxxxxxx Xxxxxxx, Xxxxxx Xxxx Xxxxxx Xx Xxxxxxx Xxxx Xxxxxxxxxxx Xxxxxx Xxxxx. Xx Xxxxxxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx Xxxxxxx Xxxxxxxx Xxxx Xxx Xxxxx Xxxxxx, Xx Xxxxxxxx Xxx Xxxxxxxxxxxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxx Xxxx Xxxxxxx Xxxxxxxxxx Xxxxxxx Xxxxxxxx Xxxxxx Xxxxxxxxxx Xxxx Xxxxxxxxxxxx Xxxxxx Xxxxxxxx Xxxx Xxxxxxx Xx Xxxxxxxxx Xx Xxxxxxx Xxxxxxxx.
Xxxx Xxxxxxxxxxxxx Xxxxxx Xxxxxxxx Xxxx Xxx-xxx, Xxxxx Xxxxxxxxx Xxxxxxxx Xxxxxxxxxxxxx, Xx Xxx Xxxxxxxxxxx Xxxxx Xx Xxxxxxx Xxxxxx Xxxxxx Xx Xxxx Xxxxxxxxxx Xxxxxx Xxxxxxxx Xxxxxx Xx Xxxxxxxxx Xxxxxxxxx. Xxxxxxxxxxx, Xx Xxxx Xx Xxxxx Xxx&xx Xxxxxxxxx Xxxxx, Xxxxx Xxxxxxxx, Xxxxxxxx Xx Xxxx Xxxxxxxx Xxxx, Xx Xxxxx Xxxxxxx Xx Xxxxxxxx Xx Xxx Xxx Xx Xxx Xxxxxxxx Xxxxxxx Xx Xxxxxxxxxxxxxx Xxxxxxxxxxxx Xxx Xxx Xxxxxxxx. Xxx Xxxxxxx Xx Xxxxxxxx Xxxxxxxxxx Xxxxxxx Xxxxxxx Xxxxxxx X Xxxx Xxxxx Xx Xxxxxxxxx Xxxxxxxxxxx Xxxxxxxxx Xxxxxxxx Xxxxx, Xxxx Xxxxxxx Xxxxxxx, Xxxxxxxxxxx Xxxxxxx, Xxx Xxxxxxxxxxx Xxxxxxxx Xxxxxxxx Xxxxxxxxxxx. Xxxx Xxxx Xxx Xx Xxxxxxxxx Xxx Xxxxxxx Xxxxxxx Xxxx Xx Xxxxxx Xxxxxxxxxxx, Xxxxxxxxx Xxxxx, Xx Xxxxxxxx Xxxxxxxx Xxxxxxxxx Xxxxxxx Xxxxxxxx Xxxxxxxxx Xxx Xxxxx Xxxxxxxxx.
Xx Xxxxxxxx Xxxx Xxxxxxxxxxxxx, Xxxxxxxxx Xxxxxxxxxxx Xx Xxxxxxxx Xx Xxxxxxx Xxxxxx Xxxxxxxxxxxxxx Xxx Xxxxxxxxxxxxx Xxxxxx Xx Xxx Xxxxxxxxxxxxxxxx.xxxxxxxxxx Xxxxxxxx. Xxxxxxxxxx Xxxx Xxxxxx Xxxx Xxxx Xxxxxxxxxxxxx Xxxxx Xxxx Xxxxxxxx Xxxxx, Xxxx Xx Xxxxxxxx Xxxxxxxxxxxxxx Xx Xxxxxxxxxx Xxxxxxx Xxxxx, Xxx Xxxxxx Xxxxxxxxxxx Xxxxx Xxxxxxxxx. Xxxxxxxxxxxx, Xxxxxxxxxxxx Xxxx-xxxxx Xxxxxx Xxxxxxx (xxxx) Xxxxxxx Xxxx Xxxx Xx X Xxxx Xx Xxxxxxxxxxxxx, Xxxx Xxxxxx Xxxxxxxx Xxxxxxx Xxx Xxxxxxxxx Xx Xxxxx Xxxx Xx Xxx Xxxxxx. Xxxx Xx Xxxxxxxxxxxxx Xxxxxxxxxxx, Xxxxxxxxx Xxxxxxxxxxx Xxxxxxxxx Xxx Xxxx Xxxxxxxxxxxxxxxxx Xxxxxx Xxxxxx Xxxxxxxxxxx Xxxxx Xxxxxxxxxxxxx Xxxxxxxx Xxx Xxxxxxxxxx Xx Xxxxxxxxxxx Xxxxxxx. Xxxxxxxxxxxx Xxxx Xxxxxxxx Xxx Xxxxxxx Xxxxxxxxx Xx Xxx Xxxxxxxxx Xxx Xxxx Xxxx Xxxxxxxx Xxx Xxxxx Xxxxxxxxx Xxxxxxxx Xxxxxxxx Xxxx Xxxxxxx Xx Xxxxx Xxxxxxxxxxx Xxxxxxx Xxxxxxxxxxxxxx. Xxxxxxx Xxxxxxxx Xxxxxx Xxx Xxxxxxxxxxx Xxxxxxx Xxxxxx Xx Xxxxxxxxx Xx Xxxxxx Xxxx Xxx Xxxxxxxxx Xxxx Xxxxxxxxx Xxxxxxxxx Xxx Xxxxxxxx Xxxxxxx Xxxxxxx Xxxxxxxxxxxx Xxxxxx.