---
id: "CVE-2026-111608"
kind: "vulnerability"
aliases: ["CVE-2026-111608"]
title: "Jeepay: authenticated merchants can delete other merchants' profit-sharing receivers"
severity: "medium"
cvss: 4.2
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["jeepay", "multi-tenant", "package", "payments", "self-hosted"]
not_affected_if: ["no-division-receivers-in-use", "single-merchant-deployment"]
published_at: "2026-10-16T18:17:39+00:00"
first_seen_at: "2026-10-23T21:57:13+00:00"
updated_at: "2026-10-25T04:41:44+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111608", "first_seen_at": "2026-10-23T21:57:13+00:00"}]
---

# Jeepay: authenticated merchants can delete other merchants' profit-sharing receivers

Jeepay through 3.2.9 checks ownership of a receiver against the wrong column, so an authenticated merchant can delete another merchant's division receiver. The attacker needs the ENT_DIVISION_RECEIVER_DELETE permission and a receiver group whose id matches the victim's receiver id.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Jeepay version; `3.2.9` and earlier are described as affected, per the NVD entry.
- unknown

## Fix

- Upgrade Jeepay past `3.2.9`; the sources do not name a fixed version.
- unknown

## Timeline

- 2026-10-23T21:57:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111608

## From the sources

Jeepay through 3.2.9 contains an insecure direct object reference vulnerability that allows authenticated merchant users to delete other merchants' division receivers by exploiting an ownership check on the wrong column. Attackers holding ENT_DIVISION_RECEIVER_DELETE who own a receiver group whose id matches a victim's receiver id can delete the victim's profit-sharing receiver.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_