Vulnerability · Published Oct 16, 2026 · Assigned by VulnCheck

CVE-2026-111607Jeepay through 3.2.9 IDOR via POST /api/mch/payConfigs

High 7.1

In plain English

A high-severity authorization bypass via user-controlled key in jeepay from jeequan. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities).

Severity (CVSS 3.1)7.1High

Exploit odds (30 days)0.2%top 83.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Jeepay through 3.2.9 contains an insecure direct object reference vulnerability that allows authenticated merchant users to overwrite another merchant application's payment channel configuration by supplying a victim infoId to MchPayInterfaceConfigController.saveOrUpdate. Attackers holding the default ENT_MCH_PAY_CONFIG_ADD permission can replace signing keys, certificates, and fee rates to break or redirect the victim merchant's payment processing.

Affected products (as reported)

Vendor	Product	Versions
jeequan	jeepay	0 – through 3.2.9

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

References

https://hackmd.io/@hieuPenguinnn/jeepay-mch-payconfig-write-and-division-receiver-delete-cross-merchant-authz third-party-advisory
https://github.com/jeequan/jeepay/blob/V3.2.9/jeepay-merchant/src/main/java/com/jeequan/jeepay/mch/ctrl/merchant/MchPayInterfaceConfigController.java#L146-L186 technical-description
VulnCheck Advisory: Jeepay through 3.2.9 IDOR via POST /api/mch/payConfigs third-party-advisory