Jeepay
Monthly
Authorization bypass in jeequan jeepay up to version 3.2.9 allows authenticated low-privilege users to circumvent access controls enforced by the PreAuthorize Handler within WebSecurityConfig, specifically targeting the SysLogController component. The flaw stems from CWE-639 (Authorization Bypass Through User-Controlled Key), enabling manipulation of access-control keys to reach system log data or restricted administrative functionality beyond the user's granted permissions. A public proof-of-concept exploit exists; no vendor response has been received and no patch has been confirmed, elevating remediation urgency despite the moderate CVSS score.
Authorization bypass in jeequan jeepay up to version 3.2.9 allows authenticated low-privilege users to circumvent access controls enforced by the PreAuthorize Handler within WebSecurityConfig, specifically targeting the SysLogController component. The flaw stems from CWE-639 (Authorization Bypass Through User-Controlled Key), enabling manipulation of access-control keys to reach system log data or restricted administrative functionality beyond the user's granted permissions. A public proof-of-concept exploit exists; no vendor response has been received and no patch has been confirmed, elevating remediation urgency despite the moderate CVSS score.