---
id: "CVE-2026-111607"
kind: "vulnerability"
aliases: ["CVE-2026-111607"]
title: "Jeepay: merchant users can overwrite other merchants' payment channel configs"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["jeepay", "multi-tenant", "other", "payments", "self-hosted"]
not_affected_if: ["no-merchant-users", "patched-version"]
published_at: "2026-10-16T18:17:39+00:00"
first_seen_at: "2026-10-23T21:57:13+00:00"
updated_at: "2026-10-25T03:36:41+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111607", "first_seen_at": "2026-10-23T21:57:13+00:00"}]
---

# Jeepay: merchant users can overwrite other merchants' payment channel configs

Jeepay through 3.2.9 lets an authenticated merchant user supply another merchant's infoId to MchPayInterfaceConfigController.saveOrUpdate and overwrite that merchant's payment channel configuration. An attacker can replace signing keys, certificates and fee rates, breaking or redirecting the victim's payment processing.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the deployed Jeepay version; the sources say versions through 3.2.9 are affected
- Review whether the default ENT_MCH_PAY_CONFIG_ADD permission is granted to merchant users
- unknown whether the sources give a specific file or setting to inspect beyond the version

## Fix

- Upgrade Jeepay to a version later than `3.2.9`; the sources do not name the fixed release
- Restrict or remove the ENT_MCH_PAY_CONFIG_ADD permission from merchant roles until patched

## Timeline

- 2026-10-23T21:57:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111607

## From the sources

Jeepay through 3.2.9 contains an insecure direct object reference vulnerability that allows authenticated merchant users to overwrite another merchant application's payment channel configuration by supplying a victim infoId to MchPayInterfaceConfigController.saveOrUpdate. Attackers holding the default ENT_MCH_PAY_CONFIG_ADD permission can replace signing keys, certificates, and fee rates to break or redirect the victim merchant's payment processing.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_