Vulnerability · Published Oct 16, 2026 · Assigned by VulnCheck

CVE-2026-111608Jeepay through 3.2.9 IDOR via DELETE /api/divisionReceivers/{recordId}

Medium 4.2

In plain English

A medium-severity authorization bypass via user-controlled key in jeepay from jeequan. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities).

Severity (CVSS 3.1)4.2Medium

Exploit odds (30 days)0.3%top 77.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Jeepay through 3.2.9 contains an insecure direct object reference vulnerability that allows authenticated merchant users to delete other merchants' division receivers by exploiting an ownership check on the wrong column. Attackers holding ENT_DIVISION_RECEIVER_DELETE who own a receiver group whose id matches a victim's receiver id can delete the victim's profit-sharing receiver.

Affected products (as reported)

Vendor	Product	Versions
jeequan	jeepay	0 – through 3.2.9

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L

References

https://hackmd.io/@hieuPenguinnn/jeepay-mch-payconfig-write-and-division-receiver-delete-cross-merchant-authz third-party-advisory
https://github.com/jeequan/jeepay/blob/V3.2.9/jeepay-merchant/src/main/java/com/jeequan/jeepay/mch/ctrl/division/MchDivisionReceiverController.java#L250-L259 technical-description
VulnCheck Advisory: Jeepay through 3.2.9 IDOR via DELETE /api/divisionReceivers/{recordId} third-party-advisory