CVE-2026-92466

zlt2000 microservices-platform through 6.0.0 contains a missing authorization vulnerability where the zlt.security.auth.urlPermission.enable flag defaults to false, disabling all permission checks after authentication. Authenticated users with no roles can access administrative APIs including use...

CVE-2026-92466 microservices-platform through 6.0.0 Missing Authorization via Disabled URL Permission Checking

zlt2000 microservices-platform through 6.0.0 contains a missing authorization vulnerability where the zlt.security.auth.urlPermission.enable flag defaults to false, disabling all permission checks after authentication. Authenticated users with no roles can access administrative APIs including use...

CVE-2026-92466

CVE-2026-92466 affects zlt2000 microservices-platform through version 6.0.0 . The root cause is the configuration flag zlt.security.auth.urlPermission.enable defaulting to false , which disables all URL-level permission checks after a user has authenticated. As a result, any authenticated user wi...

CVE-2026-92463

yshop-crm through 2.1.3 contains an authorization failure in the GET /admin-api/system/user/page endpoint where the @PreAuthorize annotation is commented out, allowing authenticated back-office users without system:user:list permission to enumerate all users. Attackers with valid back-office...

CVE-2026-92463 yshop-crm through 2.1.3 Missing Authorization via Disabled Annotation on System User Listing

yshop-crm through 2.1.3 contains an authorization failure in the GET /admin-api/system/user/page endpoint where the @PreAuthorize annotation is commented out, allowing authenticated back-office users without system:user:list permission to enumerate all users. Attackers with valid back-office...

EUVD-2026-80665

yshop-crm through 2.1.3 fails to enforce authorization on the GET /admin-api/crm/operatelog/page endpoint, allowing any authenticated back-office user to access the installation-wide audit trail. Attackers can query the operation log to retrieve operator names, display nicknames, client IP...

CVE-2026-92457 yshop-crm through 2.1.3 Missing Authorization via CrmInvoiceController issueInvoice

yshop-crm through 2.1.3 contains a missing authorization vulnerability in the CrmInvoiceController issueInvoice endpoint that allows authenticated back-office users to issue arbitrary invoices. Attackers can call the PUT /admin-api/crm/invoice/issue endpoint without required permissions to modify...

PT-2026-93705

Name of the Vulnerable Software and Affected Versions yshop-crm versions prior to 2.1.4 Description A missing authorization issue exists in the 'GET /admin-api/crm/flow/flow-users' endpoint. This allows any authenticated back-office user to access sensitive approval workflow data, including...

CVE-2026-92461: Missing Authorization

yshop-crm through 2.1.3 contains a missing authorization vulnerability in the GET /admin-api/crm/flow/flow-users endpoint that allows any logged-in back-office user to access approval workflow data. Attackers can retrieve approval chain topology, step ordering, approver identifiers, and personal...

CVE-2026-92460: Missing Authorization

yshop-crm through 2.1.3 fails to enforce authorization on the GET /admin-api/crm/operatelog/page endpoint, allowing any authenticated back-office user to access the installation-wide audit trail. Attackers can query the operation log to retrieve operator names, display nicknames, client IP...

PT-2026-93706

Name of the Vulnerable Software and Affected Versions yshop-crm versions prior to 2.1.4 Description Insufficient authorization checks in the CrmFlowController deleteFlowStep function allow any authenticated back-office user to delete arbitrary approval workflow steps. This can be achieved by...

CVE-2026-92463: Missing Authorization

yshop-crm through 2.1.3 contains an authorization failure in the GET /admin-api/system/user/page endpoint where the @PreAuthorize annotation is commented out, allowing authenticated back-office users without system:user:list permission to enumerate all users. Attackers with valid back-office...

PT-2026-93701

Name of the Vulnerable Software and Affected Versions yshop-crm versions prior to 2.1.4 Description Authenticated back-office users can issue arbitrary invoices due to missing authorization in the CrmInvoiceController issueInvoice function. By calling the PUT '/admin-api/crm/invoice/issue'...

CVE-2026-92462: Missing Authorization

yshop-crm through 2.1.3 fails to enforce authorization checks on the CrmFlowController deleteFlowStep endpoint, allowing any authenticated back-office user to delete arbitrary approval workflow steps. Attackers can invoke the DELETE /admin-api/crm/flow/delete-step endpoint without required...

PT-2026-93702

Name of the Vulnerable Software and Affected Versions yshop-crm versions prior to 2.1.4 Description A missing authorization issue exists in the onSale handler of the StoreProductController. This allows authenticated back-office users to modify the sale status of products without proper permission...

PT-2026-93707

Name of the Vulnerable Software and Affected Versions yshop-crm versions prior to 2.1.4 Description An authorization failure exists in the 'GET /admin-api/system/user/page' endpoint because the @PreAuthorize annotation is commented out. This allows authenticated back-office users who lack the...

PT-2026-93704

Name of the Vulnerable Software and Affected Versions yshop-crm versions prior to 2.1.4 Description Insufficient authorization enforcement on the 'GET /admin-api/crm/operatelog/page' endpoint allows any authenticated back-office user to access the installation-wide audit trail. This allows...

CVE-2026-90945 Crawlab through 0.6.3 Authentication Bypass via Hard-coded JWT Secret

Crawlab through 0.6.3 uses a hard-coded HMAC-SHA256 secret for JWT token signing that cannot be overridden via configuration or environment variables. Unauthenticated attackers can forge valid administrator tokens to access administrative APIs and execute code on worker nodes...

CVE-2026-90945 Crawlab through 0.6.3 Authentication Bypass via Hard-coded JWT Secret

Crawlab through 0.6.3 uses a hard-coded HMAC-SHA256 secret for JWT token signing that cannot be overridden via configuration or environment variables. Unauthenticated attackers can forge valid administrator tokens to access administrative APIs and execute code on worker nodes...

CVE-2026-90933

laradashboard through 1.2.2 contains a missing authorization vulnerability in the Local License API endpoints that allows any authenticated user to read, overwrite, and delete premium module license keys. Attackers with low-privileged accounts can access GET /api/admin/licenses/show, POST...