CVE-2026-111608: Authorization Bypass Through User-Controlled Key in jeequan jeepay

Jeepay through version 3.2.9 contains an insecure direct object reference vulnerability that enables authenticated merchant users to delete division receivers belonging to other merchants. This occurs because the ownership verification is performed on the wrong column, allowing attackers with the ENT_DIVISION_RECEIVER_DELETE permission to delete profit-sharing receivers of victims if their receiver group ID matches the victim's receiver ID. The vulnerability is identified as CVE-2026-111608 with a CVSS 4.0 base score of 2.3, reflecting low severity due to required privileges and attack complexity.

An attacker with authenticated merchant access and the ENT_DIVISION_RECEIVER_DELETE permission can delete profit-sharing receivers of other merchants by exploiting the incorrect ownership check. This could disrupt profit-sharing configurations but does not allow privilege escalation or broader system compromise. The impact is limited to unauthorized deletion of division receivers under specific conditions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict the ENT_DIVISION_RECEIVER_DELETE permission to trusted users only and monitor for suspicious deletion activities related to division receivers.