{"id":"CVE-2026-111607","title":"Jeepay through 3.2.9 contains an insecure direct object reference vulnerability that allows authenticated merchant users to overwrite another merchant application's payment channel configuration by supplying a victim infoId to MchPayInte…","summary":"Jeepay through 3.2.9 contains an insecure direct object reference vulnerability that allows authenticated merchant users to overwrite another merchant application's payment channel configuration by supplying a victim infoId to MchPayInte…","severity":"high","cvss":7.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L","cwe":["CWE-639"],"vendor":"jeequan","product":"jeepay","affected":["jeepay <= 3.2.9"],"published":"2026-10-16","updated":"2026-10-16","sourceUpdated":"2026-10-16T20:17:20.483","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111607","references":[{"url":"https://github.com/jeequan/jeepay/blob/V3.2.9/jeepay-merchant/src/main/java/com/jeequan/jeepay/mch/ctrl/merchant/MchPayInterfaceConfigController.java#L146-L186","label":"disclosure@vulncheck.com"},{"url":"https://hackmd.io/@hieuPenguinnn/jeepay-mch-payconfig-write-and-division-receiver-delete-cross-merchant-authz","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/jeepay-through-3.2.9-idor-via-post-api-mch-payconfigs","label":"disclosure@vulncheck.com"},{"url":"https://hackmd.io/@hieuPenguinnn/jeepay-mch-payconfig-write-and-division-receiver-delete-cross-merchant-authz","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"tags":["nvd","cve.org","exploit-available"],"epss":0.00249,"epssPercentile":0.16122,"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-16T19:25:42.602677Z"},"ingestedAt":"2026-10-16T18:43:08.698Z","slug":"CVE-2026-111607","body":"## Overview\n\nJeepay through 3.2.9 contains an insecure direct object reference vulnerability that allows authenticated merchant users to overwrite another merchant application's payment channel configuration by supplying a victim infoId to MchPayInterfaceConfigController.saveOrUpdate. Attackers holding the default ENT_MCH_PAY_CONFIG_ADD permission can replace signing keys, certificates, and fee rates to break or redirect the victim merchant's payment processing.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":51,"depthScoreParts":{"impact":39.1,"likelihood":0,"exploitation":12,"ransomware":0},"changes":[{"seq":223340,"id":"CVE-2026-111607","ts":1792180098952,"field":"exploit_available","old":"false","new":"true"}]}