CVE-2026-111607

7.1High

Published 16 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

7.1High

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None
Impact: High impact on integrity
Weakness: CWE-639

Impact

Authenticated merchant users can overwrite another merchant's payment channel configurations, replacing signing keys, certificates, and fee rates. This allows an attacker with basic merchant credentials to disrupt or hijack a victim merchant's payment processing.

Root cause

An insecure direct object reference (IDOR) in MchPayInterfaceConfigController.saveOrUpdate fails to verify that the supplied infoId belongs to the caller's merchant account.

Affected systems

Jeepay through 3.2.9

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

Fix & remediation

Upgrade to a version newer than 3.2.9 once available; as an interim mitigation, revoke the ENT_MCH_PAY_CONFIG_ADD permission from untrusted merchant roles or block POST requests to /api/mch/payconfigs at the reverse proxy.

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Jeepay through 3.2.9 contains an insecure direct object reference vulnerability that allows authenticated merchant users to overwrite another merchant application's payment channel configuration by supplying a victim infoId to MchPayInterfaceConfigController.saveOrUpdate. Attackers holding the default ENT_MCH_PAY_CONFIG_ADD permission can replace signing keys, certificates, and fee rates to break or redirect the victim merchant's payment processing.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-111607