CVE-2026-111607 — Jeepay through 3.2.9 IDOR via POST /api/mch/payConfigs
Jeepay through 3.2.9 contains an insecure direct object reference vulnerability that allows authenticated merchant users to overwrite another merchant application's payment chan…
Published: 2026-10-16 · CVSS: 7.1 · CVSS 4.0
Jeepay through 3.2.9 contains an insecure direct object reference vulnerability that allows authenticated merchant users to overwrite another merchant application's payment channel configuration by supplying a victim infoId to MchPayInterfaceConfigController.saveOrUpdate. Attackers holding the default ENT_MCH_PAY_CONFIG_ADD permission can replace signing keys, certificates, and fee rates to break or redirect the victim merchant's payment processing.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7