CVE-2026-18631: jeequan jeepay PreAuthorize SysLogController.java WebSecurityConfig authorization
A vulnerability was identified in jeequan jeepay up to 3.2.9. This vulnerability affects the function WebSecurityConfig of the file jeepay-manager/src/main/java/com/jeequan/jeepay/mgr/ctrl/sysuser/SysLogController.java of the component PreAuthorize Handler. The manipulation leads to authorization bypass. The attack may be initiated remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-18631?
CVE-2026-18631 is categorized as a medium severity vulnerability with a score of 6.3.
How do I fix CVE-2026-18631?
Fixing CVE-2026-18631 involves updating jeequan jeepay to version 3.2.10 or later where the vulnerability has been addressed.
What does CVE-2026-18631 affect?
CVE-2026-18631 affects the PreAuthorize Handler in the WebSecurityConfig function of the SysLogController.java file in jeequan jeepay.
What type of attack does CVE-2026-18631 enable?
CVE-2026-18631 enables unauthorized access due to improper authorization handling in the application.
Which versions of jeequan jeepay are vulnerable to CVE-2026-18631?
jeequan jeepay versions up to 3.2.9 are vulnerable to CVE-2026-18631.