{"id":"CVE-2026-111608","kind":"vulnerability","aliases":["CVE-2026-111608"],"related":[],"title":"Jeepay: authenticated merchants can delete other merchants' profit-sharing receivers","description":"Jeepay through 3.2.9 contains an insecure direct object reference vulnerability that allows authenticated merchant users to delete other merchants' division receivers by exploiting an ownership check on the wrong column. Attackers holding ENT_DIVISION_RECEIVER_DELETE who own a receiver group whose id matches a victim's receiver id can delete the victim's profit-sharing receiver.","summary":"Jeepay through 3.2.9 checks ownership of a receiver against the wrong column, so an authenticated merchant can delete another merchant's division receiver. The attacker needs the ENT_DIVISION_RECEIVER_DELETE permission and a receiver group whose id matches the victim's receiver id.","severity":"medium","cvss":4.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["jeepay","multi-tenant","package","payments","self-hosted"],"not_affected_if":["no-division-receivers-in-use","single-merchant-deployment"],"how_to_check":"- Check the installed Jeepay version; `3.2.9` and earlier are described as affected, per the NVD entry.\n- unknown","fix":"- Upgrade Jeepay past `3.2.9`; the sources do not name a fixed version.\n- unknown","status":"open","published_at":"2026-10-16T18:17:39+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","triaged_at":"2026-10-25T04:41:44+00:00","updated_at":"2026-10-25T04:41:44+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:41:44Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Jeepay past `3.2.9`; the sources do not name a fixed version.\n- unknown","reach":"network","title":"Jeepay: authenticated merchants can delete other merchants' profit-sharing receivers","impact":"medium","summary":"Jeepay through 3.2.9 checks ownership of a receiver against the wrong column, so an authenticated merchant can delete another merchant's division receiver. The attacker needs the ENT_DIVISION_RECEIVER_DELETE permission and a receiver group whose id matches the victim's receiver id.","category":"package","nicknames":[],"who_cares":["jeepay","payments","multi-tenant","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"Another merchant's profit-sharing receiver gets deleted, disrupting their payment splits.","analyst_note":"Find the fixed Jeepay release and confirm whether ENT_DIVISION_RECEIVER_DELETE is granted by default; check the NVD entry for the exact CVSS vector.","how_to_check":"- Check the installed Jeepay version; `3.2.9` and earlier are described as affected, per the NVD entry.\n- unknown","needs_analyst":true,"not_affected_if":["single-merchant-deployment","no-division-receivers-in-use"],"who_is_affected":"Deployments of Jeepay through 3.2.9 where merchant users hold the ENT_DIVISION_RECEIVER_DELETE permission and share a deployment with other merchants. Single-merchant installs with no untrusted merchant accounts are less exposed. The sources do not say how common the permission is by default.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000641,"input_tokens":3353,"output_tokens":611,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-111608':14A,17A '-2026':13A,16A '3.2.9':29B,73C 'allow':82C 'anoth':45B 'attack':51B,101C 'authent':2A,41B,83C 'check':30B,96C 'column':38B,100C 'contain':74C 'cve':12A,15A 'delet':5A,44B,57B,87C,106C,121C 'direct':77C 'divis':48B,55B,90C,104C 'ent':54B,103C 'exploit':93C 'group':62B,111C 'hold':102C 'host':26B 'id':64B,70B,113C,119C 'insecur':76C 'jeepay':1A,18B,27B,71C 'match':65B,114C 'merchant':3A,7A,42B,46B,84C,89C 'multi':20B 'multi-ten':19B 'need':52B 'object':78C 'ownership':31B,95C 'packag':22B 'payment':23B 'permiss':58B 'profit':9A,126C 'profit-shar':8A,125C 'receiv':11A,34B,49B,56B,61B,69B,91C,105C,110C,118C,128C 'refer':79C 'self':25B 'self-host':24B 'share':10A,127C 'tenant':21B 'user':85C 'victim':67B,116C,123C 'vulner':80C 'whose':63B,112C 'wrong':37B,99C","nicknames":[],"mitigations":[],"who_affected":"Deployments of Jeepay through 3.2.9 where merchant users hold the ENT_DIVISION_RECEIVER_DELETE permission and share a deployment with other merchants. Single-merchant installs with no untrusted merchant accounts are less exposed. The sources do not say how common the permission is by default.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T18:17:39+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111608","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111608","severity":null,"published_at":"2026-10-16T18:17:39+00:00","modified_at":"2026-10-23T19:17:42+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}