CVE-2026-111607

HIGH 7.1

Jeepay through 3.2.9 IDOR via POST /api/mch/payConfigs

CVSS Score

7.1

EPSS Score

0.0%

EPSS Percentile

0th

Jeepay through 3.2.9 contains an insecure direct object reference vulnerability that allows authenticated merchant users to overwrite another merchant application's payment channel configuration by supplying a victim infoId to MchPayInterfaceConfigController.saveOrUpdate. Attackers holding the default ENT_MCH_PAY_CONFIG_ADD permission can replace signing keys, certificates, and fee rates to break or redirect the victim merchant's payment processing.

CWE	CWE-639
Vendor	jeequan
Product	jeepay
Published	Oct 16, 2026

Stay Ahead of the Next One

Get instant alerts for jeequan jeepay

Be the first to know when new high vulnerabilities affecting jeequan jeepay are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

Low

Affected Versions

jeequan / jeepay

0 ≤ 3.2.9

References

NVD ↗ CVE.org ↗ EPSS Data ↗

hackmd.io: https://hackmd.io/@hieuPenguinnn/jeepay-mch-payconfig-write-and-division-receiver-delete-cross-merchant-authz github.com: https://github.com/jeequan/jeepay/blob/V3.2.9/jeepay-merchant/src/main/java/com/jeequan/jeepay/mch/ctrl/merchant/MchPayInterfaceConfigController.java#L146-L186 vulncheck.com: https://www.vulncheck.com/advisories/jeepay-through-3.2.9-idor-via-post-api-mch-payconfigs

Credits

hieuPenguinnn