CVE-2026-111608

The record

Jeepay through 3.2.9 contains an insecure direct object reference vulnerability that allows authenticated merchant users to delete other merchants' division receivers by exploiting an ownership check on the wrong column. Attackers holding ENT_DIVISION_RECEIVER_DELETE who own a receiver group whose id matches a victim's receiver id can delete the victim's profit-sharing receiver.

Affected packages

Related vulnerabilities

• CVE-2026-63401 Coop is an open source review and moderation tool from ROOST. CWE-639
• CVE-2026-63338 IXP Manager is a full-stack web application for managing Internet Exchange Points. CWE-639
• CVE-2026-62277 LubeLogger is a self-hosted, open-source, web-based vehicle maintenance and fuel mileage… CWE-639
• CVE-2026-62991 Shopper is a Headless e-commerce Admin Panel. CWE-639
• CVE-2026-119329 Immich is a high-performance self-hosted photo and video management solution. CWE-639
• CVE-2026-116239 In server mode pgAdmin 4 keeps an account per authentication source, so the same username… CWE-639
• CVE-2026-120007 NodeBB 1.18.0 through 4.16.5 contains an authorization bypass vulnerability that allows… CWE-639
• CVE-2026-107868 Unauthenticated Bypass Vulnerability in YITH WooCommerce Product Add-Ons <= 4.34.0… CWE-639