Skip to content
Heist/ feed
Back to feed
Low

Jeepay through 3.2.9 IDOR via DELETE /api/divisionReceivers/{recordId}

Type: advisorySources: OSV

Jeepay through 3.2.9 contains an insecure direct object reference vulnerability that allows authenticated merchant users to delete other merchants' division receivers by exploiting an ownership check on the wrong column. Attackers holding ENT_DIVISION_RECEIVER_DELETE who own a receiver group whose id matches a victim's receiver id can delete the victim's profit-sharing receiver.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2026-111608
Confirmed fixed CVEs
Not specified
Updated in this feed
7 Nov 2026, 04:17 UTC · Revision 1

Source evidence

Jeepay through 3.2.9 IDOR via DELETE /api/divisionReceivers/{recordId}

core-osv · Original source

Published 16 Oct 2026, 17:38 UTC

Jeepay through 3.2.9 contains an insecure direct object reference vulnerability that allows authenticated merchant users to delete other merchants' division receivers by exploiting an ownership check on the wrong column. Attackers holding ENT_DIVISION_RECEIVER_DELETE who own a receiver group whose id matches a victim's receiver id can delete the victim's profit-sharing receiver.

osv:CVE-2026-111608
Complete source record
{
  "id": "cd852dd7f223643922a5afcd02f8eb190d9eae8589070fe1838030be1194eab0",
  "url": "https://osv.dev/vulnerability/CVE-2026-111608",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Jeepay through 3.2.9 IDOR via DELETE /api/divisionReceivers/{recordId}",
    "summary": "Jeepay through 3.2.9 contains an insecure direct object reference vulnerability that allows authenticated merchant users to delete other merchants' division receivers by exploiting an ownership check on the wrong column. Attackers holding ENT_DIVISION_RECEIVER_DELETE who own a receiver group whose id matches a victim's receiver id can delete the victim's profit-sharing receiver.",
    "evidence": "osv:CVE-2026-111608",
    "products": [],
    "severity": "low",
    "structured": {
      "id": "CVE-2026-111608",
      "aliases": [
        "CVE-2026-111608"
      ],
      "metrics": [
        {
          "type": "CVSS_V4",
          "score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/jeequan/jeepay",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "last_affected": "c9215fac03a4bb556322c0b245611d573b0687cd"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "last_affected": "3.2.9"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StandardRange"
                  },
                  {
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "last_affected": "3.2.9"
                      }
                    ],
                    "source": "DESCRIPTION"
                  }
                ]
              }
            }
          ],
          "versions": [
            "V3.2.9",
            "V3.2.8",
            "V3.2.7",
            "V3.2.6",
            "V3.2.5",
            "V3.2.4",
            "V3.2.3",
            "V3.2.2",
            "V3.2.1",
            "V3.2.0",
            "V3.1.0",
            "v3.0.0",
            "V3.0.0",
            "v2.4.0",
            "V2.4.0",
            "v2.3.0",
            "v2.2.2",
            "v2.2.1",
            "v2.2.0",
            "v2.1.0",
            "v2.0.0",
            "v1.16.0",
            "v1.15.0",
            "v1.14.0",
            "v1.12.0",
            "v1.11.0",
            "v.11.0",
            "v1.10.0",
            "v1.9.0",
            "v1.8.0",
            "v1.7.0",
            "v1.6.0",
            "v1.5.1",
            "v1.5.0",
            "v1.4.0",
            "v1.2.0",
            "v1.1.1",
            "v1.1.0"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-111608.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:49.511384683Z",
      "provider": "osv",
      "references": [
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111608.json",
        "https://hackmd.io/@hieuPenguinnn/jeepay-mch-payconfig-write-and-division-receiver-delete-cross-merchant-authz",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-111608",
        "https://www.vulncheck.com/advisories/jeepay-through-3.2.9-idor-via-delete-api-divisionreceivers-recordid",
        "https://github.com/jeequan/jeepay",
        "https://github.com/jeequan/jeepay/blob/V3.2.9/jeepay-merchant/src/main/java/com/jeequan/jeepay/mch/ctrl/division/MchDivisionReceiverController.java#L250-L259"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-639"
        ],
        "cna_assigner": "VulnCheck",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111608.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-111608",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 518065,
  "published_at": "2026-10-16T17:38:49.058+00:00"
}