CVE-2026-111607: Authorization Bypass Through User-Controlled Key in jeequan jeepay

Jeepay versions up to and including 3.2.9 contain an insecure direct object reference vulnerability that permits authenticated merchant users to manipulate payment channel configurations of other merchants. By providing a victim's infoId to the MchPayInterfaceConfigController.saveOrUpdate endpoint, attackers with the ENT_MCH_PAY_CONFIG_ADD permission can overwrite sensitive configuration data including signing keys, certificates, and fee rates. This vulnerability enables unauthorized modification of payment processing settings, which could lead to payment disruption or redirection.

An attacker with authenticated merchant access and the ENT_MCH_PAY_CONFIG_ADD permission can alter another merchant's payment channel configuration. This can result in unauthorized replacement of signing keys, certificates, and fee rates, potentially causing payment processing failures or redirecting payments to attacker-controlled accounts. The vulnerability compromises the integrity and reliability of payment operations for affected merchants.

No explicit patch or remediation information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict the ENT_MCH_PAY_CONFIG_ADD permission to trusted users only and monitor for unauthorized configuration changes.