CVE-2026-18631

Name of the Vulnerable Software and Affected Versions jeequan jeepay versions prior to 3.2.10

Description An authorization bypass exists in the PreAuthorize Handler component. The issue resides in the WebSecurityConfig() function within the jeepay-manager/src/main/java/com/jeequan/jeepay/mgr/ctrl/sysuser/SysLogController.java file. This flaw allows a remote attacker to bypass authorization mechanisms.

Recommendations As a temporary workaround, restrict access to the WebSecurityConfig() function in the SysLogController.java file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.