TI-2026-75393 Aliases CVE-2026-111607 GHSA-m4g4-x529-gqm8

Jeepay lets merchants overwrite other merchants' payment configs

MEDIUM 64CWE-639Published 2026-10-16 · Updated 2026-10-16

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Security bypass
Confidentiality · integrity · availability: None · High · Low
Fix status: No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-639.

Summary

Jeepay through 3.2.9 contains an insecure direct object reference (CWE-639) that lets an authenticated merchant user reach another merchant's record through a user-supplied infoId in MchPayInterfaceConfigController.saveOrUpdate. An attacker with the default ENT_MCH_PAY_CONFIG_ADD permission can overwrite the victim's payment channel configuration, replacing signing keys, certificates and fee rates, which breaks or redirects the victim merchant's payment processing.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

Jeepay through 3.2.9 contains an insecure direct object reference vulnerability that allows authenticated merchant users to overwrite another merchant application's payment channel configuration by supplying a victim infoId to MchPayInterfaceConfigController.saveOrUpdate. Attackers holding the default ENT_MCH_PAY_CONFIG_ADD permission can replace signing keys, certificates, and fee rates to break or redirect the victim merchant's payment processing.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00249 16th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
jeequan	jeepay	up to 3.2.9	—	No fix listed	CNA

jeepay Vendorjeequan Affected up to 3.2.9 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for Jeepay.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Timeline

2026-10-16 Threatist record created from CVE-2026-111607
2026-10-16 Alias added: GHSA-m4g4-x529-gqm8
2026-10-18 CISA SSVC decision points changed

References

Advisory 1

https://hackmd.io/@hieuPenguinnn/jeepay-mch-payconfig-write-and-division-receiver-delete-cross-merchant-authz

Other 1

https://github.com/jeequan/jeepay/blob/V3.2.9/jeepay-merchant/src/main/java/com/jeequan/jeepay/mch/ctrl/merchant/MchPayInterfaceConfigController.java#L146-L186

TI-2026-15267 jeequan jeepay PreAuthorize SysLogController.java WebSecurityConfig authorization CVSS 4.0MEDIUM 5.3
TI-2026-75394 Jeepay IDOR lets merchants delete other merchants' division receivers CVSS 4.0LOW 2.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences