Description
Jeepay through 3.2.9 contains an insecure direct object reference vulnerability that allows authenticated merchant users to overwrite another merchant application's payment channel configuration by supplying a victim infoId to MchPayInterfaceConfigController.saveOrUpdate. Attackers holding the default ENT_MCH_PAY_CONFIG_ADD permission can replace signing keys, certificates, and fee rates to break or redirect the victim merchant's payment processing.
Published: 2026-10-16
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: Payment configuration tampering via IDOR
Action: Apply Patch
AI Analysis

Impact

Jeepay up to and including version 3.2.9 suffers from an insecure direct object reference that enables an authenticated merchant with the default ENT_MCH_PAY_CONFIG_ADD privilege to invoke MchPayInterfaceConfigController.saveOrUpdate with a victim's infoId. This allows overwriting the target merchant’s payment channel configuration, including signing keys, certificates, and fee rates. The result is compromised integrity of payment processing, potentially leading to financial loss, account takeover, or service disruption.

Affected Systems

Vendor: Jeepay (by jeequan). Product: Jeepay web application. Affected versions: 3.2.9 and earlier.

Risk and Exploitability

The vulnerability has a CVSS score of 7.1, EPSS is not available, and it is not listed in the CISA KEV catalog. It is exploitable over the network via POST /api/mch/payConfigs by an authenticated merchant who holds the default ENT_MCH_PAY_CONFIG_ADD permission. Successful exploitation results in unauthorized modification of payment channel settings, jeopardizing the confidentiality, integrity, and availability of the merchant’s payment processing.

Generated by OpenCVE AI on October 16, 2026 at 19:32 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Jeepay to the latest version or apply an official patch that addresses the IDOR in MchPayInterfaceConfigController.
  • If a patch is unavailable, immediately revoke the ENT_MCH_PAY_CONFIG_ADD permission from all merchants except those that absolutely require it, or enforce stricter least‑privilege controls.
  • Deploy monitoring or intrusion detection to flag unexpected POST requests to /api/mch/payConfigs and to detect sudden changes to payment channel configurations.

Generated by OpenCVE AI on October 16, 2026 at 19:32 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 17 Oct 2026 15:15:00 +0000

Type Values Removed Values Added
First Time appeared Jeequan
Jeequan jeepay
Vendors & Products Jeequan
Jeequan jeepay

Fri, 16 Oct 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 16 Oct 2026 17:45:00 +0000

Type Values Removed Values Added
Description Jeepay through 3.2.9 contains an insecure direct object reference vulnerability that allows authenticated merchant users to overwrite another merchant application's payment channel configuration by supplying a victim infoId to MchPayInterfaceConfigController.saveOrUpdate. Attackers holding the default ENT_MCH_PAY_CONFIG_ADD permission can replace signing keys, certificates, and fee rates to break or redirect the victim merchant's payment processing.
Title Jeepay through 3.2.9 IDOR via POST /api/mch/payConfigs
Weaknesses CWE-639
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L'}

cvssV4_0

{'score': 7.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N'}

Subscriptions

Jeequan Jeepay
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-16T19:26:11.339Z

Reserved: 2026-10-16T14:31:08.971Z

Link: CVE-2026-111607

cve-icon Vulnrichment

Updated: 2026-10-16T19:26:04.263Z

cve-icon NVD

Status : Deferred

Published: 2026-10-16T18:17:39.813

Modified: 2026-10-16T20:17:20.483

Link: CVE-2026-111607

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-17T15:00:09Z

Weaknesses
  • CWE-639

    Authorization Bypass Through User-Controlled Key