CVE-2026-129469

The software course-tencent-cloud prior to version 2.0.2 is susceptible to an Insecure Direct Object Reference (IDOR) vulnerability. The flaw exists in the /api/refund/confirm endpoint, where unauthenticated attackers can view other users' refund previews by supplying an order serial number (sn)....