Threat database

CVE-2026-111608 is an authorization bypass vulnerability in Jeepay versions up to 3.2.9. Authenticated merchant users with the ENT_DIVISION_RECEIVER_DELETE permission can delete other merchants' division receivers by exploiting an ownership check flaw that verifies the wrong database column. This allows attackers to delete profit-sharing receivers belonging to other merchants if certain ID conditions match. The vulnerability has a low CVSS score of 2.3, indicating limited impact and exploitability.

Jeepay through 3.2.9 contains an insecure direct object reference vulnerability that allows authenticated merchant users to overwrite another merchant application's payment channel configuration by supplying a victim infoId to MchPayInterfaceConfigController.saveOrUpdate. Attackers holding the default ENT_MCH_PAY_CONFIG_ADD permission can replace signing keys, certificates, and fee rates to break or redirect the victim merchant's payment processing.

CVE-2026-18631 is an authorization bypass vulnerability in jeequan jeepay affecting versions 3.2.0 through 3.2.9. It involves the WebSecurityConfig function in the SysLogController component, allowing remote attackers to bypass authorization controls. The vulnerability has a medium severity score of 5.3. No official patch or vendor response has been documented, and public exploit code is available.