Jeepay through 3.2.9 contains an insecure direct object reference flaw that lets an authenticated merchant delete division receivers belonging to other merchants. The vulnerability stems from an ownership check on the wrong database column and allows a user who possesses the ENT_DIVISION_RECEIVER_DELETE permission to remove a profit‑sharing receiver when the group id they own matches the victim’s receiver id. The result is the unwanted removal of another merchant’s data and potential disruption of profit‑sharing arrangements.

The issue affects Jeepay 3.2.9 and earlier versions deployed by merchants. The vulnerability is triggered via the DELETE /api/divisionReceivers/{recordId} endpoint, so any merchant application exposing that API and using the affected Jeepay release is at risk.

The CVSS score of 2.3 indicates a low severity, and the EPSS score is not available; the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is internal, requiring an authenticated merchant with delete permission. Because the flaw concerns only the deletion of a merchant’s own division receivers, the impact is limited to data integrity for the victim merchant. The overall risk is low but still significant for merchants that rely on accurate profit‑sharing configurations.