{"id":"CVE-2026-111607","title":"Jeepay through 3.2.9 IDOR via POST /api/mch/payConfigs","summary":"Jeepay through 3.2.9 contains an insecure direct object reference vulnerability that allows authenticated merchant users to overwrite another merchant application's payment channel configuration by supplying a victim infoId to MchPayInte…","severity":"high","cvss":7.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L","cvssSource":"cna","cwe":["CWE-639"],"vendor":"jeequan","product":"jeepay","affected":["jeepay <= 3.2.9"],"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-16T19:25:42.602677Z"},"exploitAvailable":true,"published":"2026-10-16","updated":"2026-10-16","sourceUpdated":"2026-10-16T19:26:11.339Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-111607","references":[{"url":"https://hackmd.io/@hieuPenguinnn/jeepay-mch-payconfig-write-and-division-receiver-delete-cross-merchant-authz"},{"url":"https://github.com/jeequan/jeepay/blob/V3.2.9/jeepay-merchant/src/main/java/com/jeequan/jeepay/mch/ctrl/merchant/MchPayInterfaceConfigController.java#L146-L186"},{"url":"https://www.vulncheck.com/advisories/jeepay-through-3.2.9-idor-via-post-api-mch-payconfigs","label":"VulnCheck Advisory: Jeepay through 3.2.9 IDOR via POST /api/mch/payConfigs"}],"tags":["cve.org","exploit-available"],"ingestedAt":"2026-10-16T18:43:08.698Z","slug":"CVE-2026-111607","body":"## Overview\n\nJeepay through 3.2.9 contains an insecure direct object reference vulnerability that allows authenticated merchant users to overwrite another merchant application's payment channel configuration by supplying a victim infoId to MchPayInterfaceConfigController.saveOrUpdate. Attackers holding the default ENT_MCH_PAY_CONFIG_ADD permission can replace signing keys, certificates, and fee rates to break or redirect the victim merchant's payment processing.\n\n## Affected\n\n- `jeepay <= 3.2.9`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":51,"depthScoreParts":{"impact":39.1,"likelihood":0,"exploitation":12,"ransomware":0},"changes":[{"seq":223340,"id":"CVE-2026-111607","ts":1792180098952,"field":"exploit_available","old":"false","new":"true"}]}