CVE-2026-111607
HighCVSS 7.1Summary
Jeepay through 3.2.9 contains an insecure direct object reference vulnerability that allows authenticated merchant users to overwrite another merchant application's payment channel configuration by supplying a victim infoId to MchPayInterfaceConfigController.saveOrUpdate. Attackers holding the default ENT_MCH_PAY_CONFIG_ADD permission can replace signing keys, certificates, and fee rates to break or redirect the victim merchant's payment processing.
Risk Assessment
An attacker can hijack or disrupt another merchant's payment flow by replacing keys and certificates, leading to financial losses and transaction integrity breaches. This may also result in redirecting funds to the attacker.
Recommendation
Upgrade Jeepay to a version later than 3.2.9 if available, or restrict the ENT_MCH_PAY_CONFIG_ADD permission. Implement ownership verification of the infoId resource before saving payment channel configuration.
Other vulnerabilities in Jeepay
See all- CVE-2026-111608Medium
Jeepay through 3.2.9 contains an insecure direct object reference vulnerability that allows authenticated merchant users to delete other merchants' division receivers by exploiting an ownership check on the wrong column. Attackers holding ENT_DIVISION_RECEIVER_DELETE who own a receiver group whose id matches a victim's receiver id can delete the victim's profit-sharing receiver.
- CVE-2026-18631Medium
A vulnerability in jeequan jeepay up to 3.2.9, affecting the WebSecurityConfig function in jeepay-manager/src/main/java/com/jeequan/jeepay/mgr/ctrl/sysuser/SysLogController.java of the PreAuthorize Handler component, leads to authorization bypass. The attack can be initiated remotely, and the exploit is publicly available.
Original NVD description (English source)
Jeepay through 3.2.9 contains an insecure direct object reference vulnerability that allows authenticated merchant users to overwrite another merchant application's payment channel configuration by supplying a victim infoId to MchPayInterfaceConfigController.saveOrUpdate. Attackers holding the default ENT_MCH_PAY_CONFIG_ADD permission can replace signing keys, certificates, and fee rates to break or redirect the victim merchant's payment processing.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS