Live › vulnerability › CVE-2026-111607
Go to dashboardJeepay through 3.2.9 lets an authenticated merchant user supply another merchant's infoId to MchPayInterfaceConfigController.saveOrUpdate and overwrite that merchant's payment channel configuration. An attacker can replace signing keys, certificates and fee rates, breaking or redirecting the victim's payment processing.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Deployments of Jeepay through 3.2.9 where merchant accounts can reach the payment channel configuration endpoint. The exposure depends on holding the default ENT_MCH_PAY_CONFIG_ADD permission and on merchants sharing one platform instance. Teams running a patched version or not using Jeepay can skip it.
No product ranges from the sources yet.
3.2.9; the sources do not name the fixed releaseEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Jeepay through 3.2.9 contains an insecure direct object reference vulnerability that allows authenticated merchant users to overwrite another merchant application's payment channel configuration by supplying a victim infoId to MchPayInterfaceConfigController.saveOrUpdate. Attackers holding the default ENT_MCH_PAY_CONFIG_ADD permission can replace signing keys, certificates, and fee rates to break or redirect the victim merchant's payment processing.
This page as .md · .json · in your agent: get_signal("CVE-2026-111607")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.