Auth bypass in Jeequan Jeepay
CVE-2026-111608
Jeepay through 3.2.9 contains an insecure direct object reference vulnerability that allows authenticated merchant users to delete other merchants' division receivers by exploiting an ownership check on the wrong column. Attackers holding ENT_DIVISION_RECEIVER_DELETE who own a receiver group whose id matches a victim's receiver id can delete the victim's profit-sharing receiver.
Vulnerability class: IDOR (Insecure Direct Object Reference)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 4.2 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L.
EPSS exploit prediction
No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.
Affected products
Weakness classification (CWE)
References
- hackmd.io/@hieuPenguinnn/jeepay-mch-payconfig-write-and-division-receiver-delet… (third-party-advisory)
- github.com/jeequan/jeepay/blob/V3.2.9/jeepay-merchant/src/main/java/com/jeequan… (technical-description)
- www.vulncheck.com/advisories/jeepay-through-3.2.9-idor-via-delete-api-divisionr… (third-party-advisory)
Frequently asked questions
- What is CVE-2026-111608?
- CVE-2026-111608 is a medium-severity vulnerability in Jeequan Jeepay, classified under Authorization Bypass Through User-Controlled Key. CVSS score: 4.2/10. Published 2026-10-16.
- How severe is CVE-2026-111608?
- Medium severity. CVSS v3 base score is 4.2 out of 10.