CVE-2026-111608
Jeepay through 3.2.9 IDOR via DELETE /api/divisionReceivers/{recordId}
- State
- Published
- Severity
- 2.3 Low
- Published
- Oct 16, 2026
- Updated
- Oct 23, 2026
- Reserved
- Oct 16, 2026
Description
Jeepay through 3.2.9 contains an insecure direct object reference vulnerability that allows authenticated merchant users to delete other merchants' division receivers by exploiting an ownership check on the wrong column. Attackers holding ENT_DIVISION_RECEIVER_DELETE who own a receiver group whose id matches a victim's receiver id can delete the victim's profit-sharing receiver.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 2.3 Low | CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 4.2 Medium | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L | VulnCheck |
Weaknesses
- CWE-639 Authorization Bypass Through User-Controlled Key
Affected Products
| Product | Versions |
|---|---|
jeepayjeequan |
|
References
- https://hackmd.io/@hieuPenguinnn/jeepay-mch-payconfig-write-and-division-receiver-delete-cross-merchant-authzthird-party-advisory
- https://github.com/jeequan/jeepay/blob/V3.2.9/jeepay-merchant/src/main/java/com/jeequan/jeepay/mch/ctrl/division/MchDivisionReceiverController.java#L250-L259technical-description
- VulnCheck Advisory: Jeepay through 3.2.9 IDOR via DELETE /api/divisionReceivers/{recordId}third-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.