CVE-2026-111607
Deferred Deferred - Pending Action

Insecure Direct Object Reference in Jeepay Allows Payment Channel Tampering

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: VulnCheck

Description
Jeepay through 3.2.9 contains an insecure direct object reference vulnerability that allows authenticated merchant users to overwrite another merchant application's payment channel configuration by supplying a victim infoId to MchPayInterfaceConfigController.saveOrUpdate. Attackers holding the default ENT_MCH_PAY_CONFIG_ADD permission can replace signing keys, certificates, and fee rates to break or redirect the victim merchant's payment processing.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-19
AI Q&A
2026-10-16
EPSS Evaluated
2026-10-18
NVD
CVE-2026-111607
EUVD
EUVD-2026-103029

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
jeequan jeepay 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-111607 is an insecure direct object reference (IDOR) vulnerability in Jeepay through version 3.2.9. It allows authenticated merchant users with the default ENT_MCH_PAY_CONFIG_ADD permission to overwrite another merchant's payment channel configuration by supplying a victim's infoId. This enables attackers to replace signing keys, certificates, and fee rates, potentially disrupting or redirecting the victim's payment processing.

Detection Guidance

To detect this vulnerability, monitor network traffic for POST requests to /api/mch/payConfigs with unexpected infoId parameters. Check application logs for unauthorized modifications to t_pay_interface_config. Review user permissions for default ENT_MCH_PAY_CONFIG_ADD access.

Impact Analysis

If you are a merchant using Jeepay, an attacker could manipulate your payment processing by changing signing keys, certificates, or fee rates. This could lead to unauthorized transactions, redirected payments, or financial losses. The attack requires only standard permissions and no additional privileges.

Compliance Impact

This vulnerability allows attackers to overwrite payment channel configurations, including signing keys and certificates, which could lead to unauthorized access to sensitive payment data. This may violate GDPR's data protection requirements for secure processing and HIPAA's safeguards for protected health information if payment data is involved.

Mitigation Strategies

Immediately update Jeepay to the latest version beyond 3.2.9. Remove default ENT_MCH_PAY_CONFIG_ADD permissions from non-admin users. Implement strict ownership validation for all merchant application modifications. Review and revoke any unauthorized changes to payment configurations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111607. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart