roncoo-education EUVD-2026-103033

Requires a valid authenticated user account on the roncoo-education platform (CVSS PR:L), and the ability to supply another user's order number to the pay 'cancel' or 'continue' endpoints handled in AuthOrderPayBiz. The exploitation condition is the absence of an ownership check in these two specific payment-order endpoints, so any logged-in user can act on any order number they can discover or guess. Limiting factors: the attacker must be authenticated (not anonymous), must know or enumerate valid victim order numbers, and impact is confined to closing pending orders and disclosing course IDs/prices - no payment funds, credentials, or server control are exposed. The affected version is roncoo-education through 25.0.0-RELEASE.

This is a CWE-639 insecure direct object reference (IDOR) in roncoo-education, an open-source online learning platform. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N) scores 5.3 (Medium) and is internally consistent with the description: network-reachable, low complexity, but requiring low-level privileges (PR:L) - meaning an authenticated but ordinary user account. Impact is limited and honest: low confidentiality (reading other users' course IDs and prices) and low integrity (cancelling/closing other users' pending orders), with no availability impact. No EPSS score, CISA KEV listing, or explicit POC flag was supplied, so there is no evidence of active exploitation or widespread automated attacks; the reporting is from VulnCheck plus an independent HackMD technical writeup pinpointing the vulnerable code (AuthOrderPayBiz.java lines 131-231). The signals are coherent rather than conflicting - this is a genuine authorization flaw but a modest-severity one: it affects a niche product, requires a valid authenticated session, and yields limited data disclosure and order-state tampering rather than account takeover or RCE. Treat it as a real-but-low-priority access-control bug to patch in routine maintenance, not an emergency. Note: the 'Authentication Bypass' tag overstates the issue - authentication is NOT bypassed; authenticated users bypass authorization (ownership) checks.

An attacker registers or already holds a normal authenticated account on a roncoo-education deployment, then calls the pay cancel or pay continue endpoint while substituting another user's order number in place of their own. Because the backend performs no ownership check, the attacker can close a victim's pending order (denial of the victim's purchase flow) or read the course IDs and prices tied to that order. A detailed technical writeup citing the exact vulnerable code lines exists publicly, but no packaged exploit tool or active exploitation was indicated in the provided data.