{"id":"CVE-2026-111607","kind":"vulnerability","aliases":["CVE-2026-111607"],"related":[],"title":"Jeepay: merchant users can overwrite other merchants' payment channel configs","description":"Jeepay through 3.2.9 contains an insecure direct object reference vulnerability that allows authenticated merchant users to overwrite another merchant application's payment channel configuration by supplying a victim infoId to MchPayInterfaceConfigController.saveOrUpdate. Attackers holding the default ENT_MCH_PAY_CONFIG_ADD permission can replace signing keys, certificates, and fee rates to break or redirect the victim merchant's payment processing.","summary":"Jeepay through 3.2.9 lets an authenticated merchant user supply another merchant's infoId to MchPayInterfaceConfigController.saveOrUpdate and overwrite that merchant's payment channel configuration. An attacker can replace signing keys, certificates and fee rates, breaking or redirecting the victim's payment processing.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["jeepay","multi-tenant","other","payments","self-hosted"],"not_affected_if":["no-merchant-users","patched-version"],"how_to_check":"- Check the deployed Jeepay version; the sources say versions through 3.2.9 are affected\n- Review whether the default ENT_MCH_PAY_CONFIG_ADD permission is granted to merchant users\n- unknown whether the sources give a specific file or setting to inspect beyond the version","fix":"- Upgrade Jeepay to a version later than `3.2.9`; the sources do not name the fixed release\n- Restrict or remove the ENT_MCH_PAY_CONFIG_ADD permission from merchant roles until patched","status":"open","published_at":"2026-10-16T18:17:39+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","triaged_at":"2026-10-25T03:36:41+00:00","updated_at":"2026-10-25T03:36:41+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-10-25T03:36:41Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Jeepay to a version later than `3.2.9`; the sources do not name the fixed release\n- Restrict or remove the ENT_MCH_PAY_CONFIG_ADD permission from merchant roles until patched","reach":"internet","title":"Jeepay: merchant users can overwrite other merchants' payment channel configs","impact":"high","summary":"Jeepay through 3.2.9 lets an authenticated merchant user supply another merchant's infoId to MchPayInterfaceConfigController.saveOrUpdate and overwrite that merchant's payment channel configuration. An attacker can replace signing keys, certificates and fee rates, breaking or redirecting the victim's payment processing.","category":"other","nicknames":[],"who_cares":["jeepay","payments","self-hosted","multi-tenant"],"confidence":0.7,"needs_auth":"yes","worst_case":"Attacker redirects another merchant's payments and replaces their signing keys","analyst_note":"Find the fixed Jeepay version and the specific patch or advisory; the NVD entry alone does not name it.","how_to_check":"- Check the deployed Jeepay version; the sources say versions through 3.2.9 are affected\n- Review whether the default ENT_MCH_PAY_CONFIG_ADD permission is granted to merchant users\n- unknown whether the sources give a specific file or setting to inspect beyond the version","needs_analyst":true,"not_affected_if":["patched-version","no-merchant-users"],"who_is_affected":"Deployments of Jeepay through 3.2.9 where merchant accounts can reach the payment channel configuration endpoint. The exposure depends on holding the default ENT_MCH_PAY_CONFIG_ADD permission and on merchants sharing one platform instance. Teams running a patched version or not using Jeepay can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000676,"input_tokens":3377,"output_tokens":676,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-111607':13A,16A '-2026':12A,15A '3.2.9':28B,69C 'add':106C 'allow':78C 'anoth':35B,84C 'applic':86C 'attack':50B,98C 'authent':31B,79C 'break':59B,117C 'certif':55B,112C 'channel':9A,47B,89C 'config':10A,105C 'configur':48B,90C 'contain':70C 'cve':11A,14A 'default':101C 'direct':73C 'ent':102C 'fee':57B,114C 'hold':99C 'host':25B 'infoid':38B,95C 'insecur':72C 'jeepay':1A,17B,26B,67C 'key':54B,111C 'let':29B 'mch':103C 'mchpayinterfaceconfigcontroller.saveorupdate':40B,97C 'merchant':2A,7A,32B,36B,44B,80C,85C,122C 'multi':19B 'multi-ten':18B 'object':74C 'overwrit':5A,42B,83C 'pay':104C 'payment':8A,22B,46B,65B,88C,124C 'permiss':107C 'process':66B,125C 'rate':58B,115C 'redirect':61B,119C 'refer':75C 'replac':52B,109C 'self':24B 'self-host':23B 'sign':53B,110C 'suppli':34B,92C 'tenant':20B 'user':3A,33B,81C 'victim':63B,94C,121C 'vulner':76C","nicknames":[],"mitigations":[],"who_affected":"Deployments of Jeepay through 3.2.9 where merchant accounts can reach the payment channel configuration endpoint. The exposure depends on holding the default ENT_MCH_PAY_CONFIG_ADD permission and on merchants sharing one platform instance. Teams running a patched version or not using Jeepay can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T18:17:39+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111607","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111607","severity":null,"published_at":"2026-10-16T18:17:39+00:00","modified_at":"2026-10-16T20:17:20+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}