CVE-2026-111607: Jeepay through 3.2.9 IDOR via POST /api/mch/payConfigs

Q: What level of access does an attacker need?

The attacker must be an authenticated merchant user with the ENT_MCH_PAY_CONFIG_ADD permission. This permission is identified as the default permission needed for exploitation.

Q: Is user interaction required for exploitation?

No. The attack can be carried out remotely through a POST request to the affected API endpoint without user interaction.

Q: What can an attacker change in another merchant's configuration?

An attacker can overwrite another merchant application's payment channel configuration, including signing keys, certificates, and fee rates. This can disrupt payment processing or redirect it.

Q: Which versions are affected?

Jeepay versions through 3.2.9 are affected.

Published Oct 16, 2026

Updated

Jeepay through 3.2.9 contains an insecure direct object reference vulnerability that allows authenticated merchant users to overwrite another merchant application's payment channel configuration by supplying a victim infoId to MchPayInterfaceConfigController.saveOrUpdate. Attackers holding the default ENTMCHPAYCONFIGADD permission can replace signing keys, certificates, and fee rates to break or redirect the victim merchant's payment processing.

Affected Software

1 affected component

Jeepay Jeepay<=3.2.9

Event History

Oct 16, 2026

CVE Published

via MITRE·05:38 PM

Data Sourced

via MITRE·05:38 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What level of access does an attacker need?

The attacker must be an authenticated merchant user with the ENT_MCH_PAY_CONFIG_ADD permission. This permission is identified as the default permission needed for exploitation.

Is user interaction required for exploitation?

No. The attack can be carried out remotely through a POST request to the affected API endpoint without user interaction.

What can an attacker change in another merchant's configuration?

An attacker can overwrite another merchant application's payment channel configuration, including signing keys, certificates, and fee rates. This can disrupt payment processing or redirect it.

Which versions are affected?

Jeepay versions through 3.2.9 are affected.

CVE-2026-111607: Jeepay through 3.2.9 IDOR via POST /api/mch/payConfigs

Affected Software

Event History

Frequently Asked Questions

What level of access does an attacker need?

Is user interaction required for exploitation?

What can an attacker change in another merchant's configuration?

Which versions are affected?

Company

Resources

Contact

Frequently Asked Questions

What level of access does an attacker need?

Is user interaction required for exploitation?

What can an attacker change in another merchant's configuration?

Which versions are affected?