# CVE-2026-18631: Jeequan Jeepay authorization bypass in WebSecurityConfig

Source: https://junglewise.ai/threats/cve-2026-18631-jeequan-jeepay-authorization-bypass-in-websecurityconfig  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-03. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-18631 · Severity: medium · CVSS 6.3 · Published 2026-08-03

Jeepay is a payment system management platform used to process and administer payment transactions. An authorization bypass vulnerability allows authenticated low-privilege users to access administrative APIs they should not have permission to view, potentially exposing sensitive system logs, payment configurations, merchant data, and enabling unauthorized administrative operations.

Technologies: [Jeequan Jeepay](https://junglewise.ai/threats/technologies/jeepay). Vendors: [Jeequan](https://junglewise.ai/threats/vendors/jeequan).

## Quick answers

**Is CVE-2026-18631 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-18631 being exploited in the wild.

**How severe is CVE-2026-18631?** Medium severity, with a CVSS score of 6.3, published 3 August 2026.

**Which products and versions are affected?** Jeequan Jeepay up to 3.2.9.

**Is there a fix for CVE-2026-18631?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-18631 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-18631?** Check whether you run Jeequan Jeepay at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an authorization bypass caused by missing method-level security enforcement in Spring Security configuration. The application declares @PreAuthorize annotations on controller methods (e.g., @PreAuthorize("hasAuthority('ENT_LOG_LIST')")) in SysLogController and other endpoints, but the WebSecurityConfig class does not enable @EnableMethodSecurity. This causes the web-layer rule anyRequest().authenticated() to be the only enforced check, allowing any authenticated user to access protected endpoints regardless of their assigned permissions. An authenticated low-privilege user can directly request protected APIs such as GET /api/sysLog and receive HTTP 200 with sensitive data. No authentication bypass is required; the attacker must be an authenticated system user, and the exploit is publicly available.

## Affected products

- Jeequan Jeepay up to 3.2.9

## Timeline

- 2026-08-03: disclosed: CVE-2026-18631 published
- 2026-06-09: other: Vulnerability verified in local environment

## References

- [https://gist.github.com/glockie029/768b792112dd05b6d0037a83a6d9d993](https://gist.github.com/glockie029/768b792112dd05b6d0037a83a6d9d993)
- [https://vuldb.com/cve/CVE-2026-18631](https://vuldb.com/cve/CVE-2026-18631)

## Related threats

- [Jeepay insecure direct object reference in division receiver deletion](https://junglewise.ai/threats/cve-2026-111608-jeepay-through-3-2-9-contains-an-insecure-direct-object)
- [Jeepay merchant console insecure direct object reference in payment config](https://junglewise.ai/threats/cve-2026-111607-jeepay-through-3-2-9-contains-an-insecure-direct-object)