This vulnerability in jeequan jeepay up to version 3.2.9 affects the WebSecurityConfig function of the SysLogController.java file's PreAuthorize Handler component. The flaw allows an attacker to manipulate authorization checks, resulting in an authorization bypass. The attack can be initiated remotely without user interaction and requires low privileges. Although exploit code is publicly available, there is no known active exploitation in the wild. The vendor has not responded to disclosure attempts, and no official fix or patch has been published.

Successful exploitation of this vulnerability allows an attacker with limited privileges to bypass authorization controls remotely, potentially gaining unauthorized access to restricted functions or data within the jeepay system. This could lead to unauthorized actions or data exposure depending on the system's configuration and usage.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should monitor for updates from the vendor or community. Until a patch is released, consider restricting access to the affected components and applying compensating controls to limit exposure.