CVE-2026-111607 Details

A vulnerability allowing insecure direct object reference (IDOR) has been identified in Jeepay versions through 3.2.9. This vulnerability allows authenticated merchant users to overwrite another merchant application's payment channel configuration. The issue arises in the 'MchPayInterfaceConfigController.saveOrUpdate' method, where an attacker can supply a victim's 'infoId' to modify channel credentials, including signing keys and fee rates. This manipulation can disrupt or redirect the victim merchant's payment processing. The vulnerability is present in the Jeepay merchant console, which authenticates users via JWTs that correspond to merchant numbers. Notably, the 'saveOrUpdate' method lacks a crucial ownership check, enabling cross-merchant interference.

The vulnerability can be addressed by implementing ownership checks for application IDs before allowing configuration changes and by correcting the deletion process for division receivers to ensure it targets the correct records.