{"id":"CVE-2026-111607","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-111607","summary":"Jeepay through 3.2.9 IDOR via POST /api/mch/payConfigs","details":"Jeepay through 3.2.9 contains an insecure direct object reference vulnerability that allows authenticated merchant users to overwrite another merchant application's payment channel configuration by supplying a victim infoId to MchPayInterfaceConfigController.saveOrUpdate. Attackers holding the default ENT_MCH_PAY_CONFIG_ADD permission can replace signing keys, certificates, and fee rates to break or redirect the victim merchant's payment processing.","published":"2026-10-16T17:38:48.333Z","modified":"2026-10-17T10:30:15.513370777Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[],"fix":null,"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111607.json"},{"type":"PACKAGE","url":"https://github.com/jeequan/jeepay"},{"type":"ARTICLE","url":"https://github.com/jeequan/jeepay/blob/V3.2.9/jeepay-merchant/src/main/java/com/jeequan/jeepay/mch/ctrl/merchant/MchPayInterfaceConfigController.java#L146-L186"},{"type":"ADVISORY","url":"https://hackmd.io/@hieuPenguinnn/jeepay-mch-payconfig-write-and-division-receiver-delete-cross-merchant-authz"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111607"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/jeepay-through-3.2.9-idor-via-post-api-mch-payconfigs"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-17T10:30:15.513370777Z"}}