Is CVE-2026-18631 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-18631 being exploited in the wild.

How severe is CVE-2026-18631?

Medium severity, with a CVSS score of 6.3, published 3 August 2026.

Is there a fix for CVE-2026-18631?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-18631 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-18631?

Check whether you run Jeequan Jeepay at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-18631: Jeequan Jeepay authorization bypass in WebSecurityConfig

CVE-2026-18631 · Severity: medium · CVSS 6.3 · Published 2026-08-03

Jeepay is a payment system management platform used to process and administer payment transactions. An authorization bypass vulnerability allows authenticated low-privilege users to access administrative APIs they should not have permission to view, potentially exposing sensitive system logs, payment configurations, merchant data, and enabling unauthorized administrative operations.

Technologies: Jeequan Jeepay. Vendors: Jeequan.

Quick answers

Is CVE-2026-18631 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-18631 being exploited in the wild.
How severe is CVE-2026-18631?: Medium severity, with a CVSS score of 6.3, published 3 August 2026.
Which products and versions are affected?: Jeequan Jeepay up to 3.2.9.
Is there a fix for CVE-2026-18631?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-18631 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-18631?: Check whether you run Jeequan Jeepay at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an authorization bypass caused by missing method-level security enforcement in Spring Security configuration. The application declares @PreAuthorize annotations on controller methods (e.g., @PreAuthorize("hasAuthority('ENT_LOG_LIST')")) in SysLogController and other endpoints, but the WebSecurityConfig class does not enable @EnableMethodSecurity. This causes the web-layer rule anyRequest().authenticated() to be the only enforced check, allowing any authenticated user to access protected endpoints regardless of their assigned permissions. An authenticated low-privilege user can directly request protected APIs such as GET /api/sysLog and receive HTTP 200 with sensitive data. No authentication bypass is required; the attacker must be an authenticated system user, and the exploit is publicly available.

Affected products

Jeequan Jeepay up to 3.2.9

Timeline

2026-08-03: disclosed: CVE-2026-18631 published
2026-06-09: other: Vulnerability verified in local environment

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.