CVE-2026-111608

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-111608
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-111608.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-111608
Published
2026-10-16T17:38:49Z
Modified
2026-10-24T02:48:16Z
Severity
  • 2.3 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N CVSS Calculator
Summary
Jeepay through 3.2.9 IDOR via DELETE /api/divisionReceivers/{recordId}
Details

Jeepay through 3.2.9 contains an insecure direct object reference vulnerability that allows authenticated merchant users to delete other merchants' division receivers by exploiting an ownership check on the wrong column. Attackers holding ENT_DIVISION_RECEIVER_DELETE who own a receiver group whose id matches a victim's receiver id can delete the victim's profit-sharing receiver.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-639"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111608.json"
}
References

Affected packages

Git / github.com/jeequan/jeepay

Affected ranges

Type
GIT
Repo
https://github.com/jeequan/jeepay
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last Affected
c9215fac03a4bb556322c0b245611d573b0687cd
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "last_affected":  "3.2.9"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        },
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "last_affected":  "3.2.9"
                }
            ],
            "source":  "DESCRIPTION"
        }
    ]
}

Affected versions

V2.*
V2.4.0
V3.*
V3.0.0
V3.1.0
V3.2.0
V3.2.1
V3.2.2
V3.2.3
V3.2.4
V3.2.5
V3.2.6
V3.2.7
V3.2.8
V3.2.9
v.*
v.11.0
v1.*
v1.1.0
v1.1.1
v1.10.0
v1.11.0
v1.12.0
v1.14.0
v1.15.0
v1.16.0
v1.2.0
v1.4.0
v1.5.0
v1.5.1
v1.6.0
v1.7.0
v1.8.0
v1.9.0
v2.*
v2.0.0
v2.1.0
v2.2.0
v2.2.1
v2.2.2
v2.3.0
v2.4.0
v3.*
v3.0.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-111608.json"