{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/payment-security/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:jeepay:jeepay:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.1,"id":"CVE-2026-111607"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Jeepay (\u003c= 3.2.9)"],"_cs_severities":["medium"],"_cs_tags":["idor","payment-security","financial-fraud"],"_cs_type":"advisory","_cs_vendors":["Jeepay"],"content_html":"\u003cp\u003eJeepay, an open-source payment system, contains an insecure direct object reference (IDOR) vulnerability identified as CVE-2026-111607. The vulnerability exists in the MchPayInterfaceConfigController.saveOrUpdate method, which fails to properly validate the ownership of the payment channel configuration being updated. Authenticated merchant users possessing the default ENT_MCH_PAY_CONFIG_ADD permission can exploit this flaw by manipulating the infoId parameter in their requests. By substituting the infoId with that of a victim merchant, an attacker can overwrite critical payment settings, including signing keys, certificates, and fee rates. This allows for the redirection of payment traffic, potential theft of transaction funds, or complete denial of service for the targeted merchant. This vulnerability impacts all Jeepay deployments version 3.2.9 and earlier.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in unauthorized modification of payment processing infrastructure. Victims face significant financial risk, as attackers can intercept transaction signing parameters, redirect payments to unauthorized channels, or disrupt payment operations. This vulnerability poses a severe risk to multi-tenant payment platforms where merchant isolation is critical for financial integrity.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eApply the vendor-provided patch or upgrade to a version of Jeepay beyond 3.2.9 immediately to resolve CVE-2026-111607.\u003c/li\u003e\n\u003cli\u003eAudit access logs for the MchPayInterfaceConfigController.saveOrUpdate endpoint to identify requests where the infoId parameter does not align with the authenticated session's merchant ID.\u003c/li\u003e\n\u003cli\u003eReview merchant permission assignments to identify users holding the ENT_MCH_PAY_CONFIG_ADD privilege who should not have access to manage payment configurations.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-16T18:46:34Z","date_published":"2026-10-16T18:46:34Z","id":"https://feed.craftedsignal.io/briefs/2026-10-jeepay-idor/","summary":"An insecure direct object reference vulnerability in Jeepay versions 3.2.9 and earlier allows authenticated merchant users to overwrite arbitrary payment channel configurations, enabling payment redirection or service disruption.","title":"IDOR Vulnerability in Jeepay Payment Configuration","url":"https://feed.craftedsignal.io/briefs/2026-10-jeepay-idor/"}],"language":"en","title":"CraftedSignal Threat Feed - Payment-Security","version":"https://jsonfeed.org/version/1.1"}