提交 #643837: roncoo roncoo-pay latest broken function level authorisation

Title: Broken Function Level Authorization in UserInfoController

PoC:

A direct GET or POST request to /user/info/list without proper authentication or authorization allows access to the user list functionality.

• 来源: ⚠️ https://www.cnblogs.com/aibot/p/19063475
• 用户: Anonymous User
• 提交: 2025-08-29 06時00分 (8 月前)
• 管理: 2025-09-11 19時22分 (14 days later)
• 状态: 已接受
• VulDB条目: 323650 [roncoo roncoo-pay 直到 9428382af21cd5568319eae7429b7e1d0332ff40 /user/info/list 弱身份验证]
• 积分: 16