CVE-2026-111608
MediumCVSS 4.2Summary
Jeepay through 3.2.9 contains an insecure direct object reference vulnerability that allows authenticated merchant users to delete other merchants' division receivers by exploiting an ownership check on the wrong column. Attackers holding ENT_DIVISION_RECEIVER_DELETE who own a receiver group whose id matches a victim's receiver id can delete the victim's profit-sharing receiver.
Risk Assessment
The ability to delete other merchants' profit-sharing receivers can lead to financial settlement disruptions and losses for affected parties. This undermines the integrity of the payment system and trust in the platform.
Recommendation
Upgrade Jeepay beyond 3.2.9 as soon as a fixed version is available, and fix the ownership check in the division receiver deletion operation. Consider auditing logs for unusual ENT_DIVISION_RECEIVER_DELETE operations.
Other vulnerabilities in Jeepay
See all- CVE-2026-111607High
Jeepay through 3.2.9 contains an insecure direct object reference vulnerability that allows authenticated merchant users to overwrite another merchant application's payment channel configuration by supplying a victim infoId to MchPayInterfaceConfigController.saveOrUpdate. Attackers holding the default ENT_MCH_PAY_CONFIG_ADD permission can replace signing keys, certificates, and fee rates to break or redirect the victim merchant's payment processing.
- CVE-2026-18631Medium
A vulnerability in jeequan jeepay up to 3.2.9, affecting the WebSecurityConfig function in jeepay-manager/src/main/java/com/jeequan/jeepay/mgr/ctrl/sysuser/SysLogController.java of the PreAuthorize Handler component, leads to authorization bypass. The attack can be initiated remotely, and the exploit is publicly available.
Original NVD description (English source)
Jeepay through 3.2.9 contains an insecure direct object reference vulnerability that allows authenticated merchant users to delete other merchants' division receivers by exploiting an ownership check on the wrong column. Attackers holding ENT_DIVISION_RECEIVER_DELETE who own a receiver group whose id matches a victim's receiver id can delete the victim's profit-sharing receiver.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS