Jeepay CVE-2026-111608

Exploitation requires an authenticated merchant account that holds the ENT_DIVISION_RECEIVER_DELETE entitlement, plus ownership of a division receiver group whose id value collides with the target victim's receiver id - the ownership check is performed against the wrong column (receiver-group ownership) rather than the receiver record itself. The practical limiting factors are significant: the attacker must already be a provisioned merchant with the specific delete permission, and must engineer or find an id match between their owned group and the victim's receiver, which is why the CVSS carries AC:H and AT:P. Impact is confined to deletion of profit-sharing receiver records (integrity/availability), with no read access to victim data.

This is a genuinely low-priority issue, and the signals are consistent in saying so. The CVSS 4.0 base score is 2.3 (Low), driven by AV:N but offset by AC:H, AT:P (a specific attack requirement), PR:L (authenticated merchant), and only partial integrity/availability impact (VI:L/VA:L) with no confidentiality impact (VC:N). The vector aligns well with the description: exploitation is not trivially repeatable because it depends on an attacker-controlled receiver-group id coincidentally matching a victim's receiver id, which is why AC:H and AT:P are appropriate. No EPSS score, KEV listing, or POC indicator is provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. There are no conflicting signals here - a low CVSS correctly reflects a narrow, authenticated, conditions-dependent authorization flaw rather than a widely weaponizable bug. The main caveat is data completeness: EPSS and POC status are simply absent from the feed (absence is not evidence either way), and the fix/patch status is not stated.

A legitimate but malicious merchant user with the ENT_DIVISION_RECEIVER_DELETE permission creates or identifies a profit-sharing receiver group under their own account whose id happens to match the receiver id belonging to a different merchant. They then invoke the division-receiver delete API, and because the ownership check validates the wrong column, the platform deletes the victim merchant's profit-sharing receiver, disrupting that merchant's payout configuration. No public exploit code is identified in the provided data, but a technical write-up describing the flaw is referenced.