CVE-2026-129469 | Tencent course-tencent-cloud up to 2.0.1 Refund Confirm /api/refund/confirm order_sn resource injection (EUVD-2026-126019)

November 15, 2026 Yanac

A vulnerability classified as problematic has been found in Tencent course-tencent-cloud up to 2.0.1. This issue affects some unknown processing of the file /api/refund/confirm of the component Refund Confirm. This manipulation of the argument order_sn causes improper control of resource identifiers.

This vulnerability is registered as CVE-2026-129469. Remote exploitation of the attack is possible. No exploit is available.

It is recommended to upgrade the affected component.VulDB Recent EntriesRead More