CVE-2026-111608 Jeepay through 3.2.9 IDOR via DELETE /api/divisionReceivers/{recordId}
Authenticated merchants can delete other merchants' profit-sharing receivers due to an insecure direct object reference in the division receivers API.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-111608?
CVE-2026-111608 is a low-severity missing authorization vulnerability in jeequan jeepay, published on 16 Oct 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Jeepay through 3.2.9 contains an insecure direct object reference vulnerability that allows authenticated merchant users to delete other merchants' division receivers by exploiting an ownership check on the wrong column. Attackers holding ENT_DIVISION_RECEIVER_DELETE who own a receiver group whose id matches a victim's receiver id can delete the victim's profit-sharing receiver.
Weakness: CWE-639
Which versions are affected by CVE-2026-111608?
How do I fix CVE-2026-111608?
No fix has been published for CVE-2026-111608 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-111608 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-111608 exists.
Sources
Also known as GHSA-gfff-pw4q-26jh.