Live › vulnerability › CVE-2026-111608
Go to dashboardJeepay through 3.2.9 checks ownership of a receiver against the wrong column, so an authenticated merchant can delete another merchant's division receiver. The attacker needs the ENT_DIVISION_RECEIVER_DELETE permission and a receiver group whose id matches the victim's receiver id.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Deployments of Jeepay through 3.2.9 where merchant users hold the ENT_DIVISION_RECEIVER_DELETE permission and share a deployment with other merchants. Single-merchant installs with no untrusted merchant accounts are less exposed. The sources do not say how common the permission is by default.
No product ranges from the sources yet.
3.2.9 and earlier are described as affected, per the NVD entry.3.2.9; the sources do not name a fixed version.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Jeepay through 3.2.9 contains an insecure direct object reference vulnerability that allows authenticated merchant users to delete other merchants' division receivers by exploiting an ownership check on the wrong column. Attackers holding ENT_DIVISION_RECEIVER_DELETE who own a receiver group whose id matches a victim's receiver id can delete the victim's profit-sharing receiver.
This page as .md · .json · in your agent: get_signal("CVE-2026-111608")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.