Is CVE-2026-111607 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-111607 being exploited in the wild.

How severe is CVE-2026-111607?

High severity, with a CVSS score of 7.1, published 16 October 2026.

Which products and versions are affected?

Jeequan Jeepay 3.2.9 and earlier.

Is there a fix for CVE-2026-111607?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-111607 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-111607?

Check whether you run Jeequan Jeepay at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-111607: Jeepay merchant console insecure direct object reference in payment config

CVE-2026-111607 · Severity: high · CVSS 7.1 · Published 2026-10-16

Jeepay is an open-source payment gateway used to process payments across multiple merchant accounts. A vulnerability in the merchant console allows authenticated users to overwrite another merchant's payment processing credentials and fee rates by directly manipulating configuration IDs, potentially enabling payment redirection, fraud, or service disruption for victim merchants.

Technologies: Jeequan Jeepay. Vendors: Jeequan.

Quick answers

Is CVE-2026-111607 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-111607 being exploited in the wild.
How severe is CVE-2026-111607?: High severity, with a CVSS score of 7.1, published 16 October 2026.
Which products and versions are affected?: Jeequan Jeepay 3.2.9 and earlier.
Is there a fix for CVE-2026-111607?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-111607 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-111607?: Check whether you run Jeequan Jeepay at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an insecure direct object reference (IDOR) in MchPayInterfaceConfigController.saveOrUpdate that accepts an appId (infoId) from the request body without verifying ownership by the calling merchant. The method directly creates or updates PayInterfaceConfig rows keyed on (INFO_TYPE_MCH_APP, infoId, ifCode) and stores sensitive channel credentials in if_params (signing keys, certificates), allowing an attacker to overwrite a victim merchant's payment signing material and fee configuration. The vulnerability requires authentication with the default ENT_MCH_PAY_CONFIG_ADD permission and is reachable via POST /api/mch/payConfigs.

Affected products

jeequan Jeepay 3.2.9 and earlier

Timeline

2026-10-16: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.