CVE-2026-92463

yshop-crm through 2.1.3 has an authorization bypass in the GET /admin-api/system/user/page endpoint, where the @PreAuthorize annotation is commented out. This allows any authenticated back-office user—without the system:user:list permission—to enumerate the complete user directory, including logi...

CVE-2026-92463 yshop-crm through 2.1.3 Missing Authorization via Disabled Annotation on System User Listing

yshop-crm through 2.1.3 contains an authorization failure in the GET /admin-api/system/user/page endpoint where the @PreAuthorize annotation is commented out, allowing authenticated back-office users without system:user:list permission to enumerate all users. Attackers with valid back-office...

EUVD-2026-80668

yshop-crm through 2.1.3 contains an authorization failure in the GET /admin-api/system/user/page endpoint where the @PreAuthorize annotation is commented out, allowing authenticated back-office users without system:user:list permission to enumerate all users. Attackers with valid back-office...

CVE-2026-92462 yshop-crm through 2.1.3 Missing Authorization via CrmFlowController deleteFlowStep

yshop-crm through 2.1.3 fails to enforce authorization checks on the CrmFlowController deleteFlowStep endpoint, allowing any authenticated back-office user to delete arbitrary approval workflow steps. Attackers can invoke the DELETE /admin-api/crm/flow/delete-step endpoint without required...

CVE-2026-92462

yshop-crm through version 2.1.3 is vulnerable to a missing authorization flaw in the CrmFlowController deleteFlowStep endpoint (DELETE /admin-api/crm/flow/delete-step). Any authenticated back-office user can invoke this endpoint without the required permissions to delete arbitrary approval workfl...

CVE-2026-92461 yshop-crm through 2.1.3 Missing Authorization via CRM Approval-Chain Endpoint

yshop-crm through 2.1.3 contains a missing authorization vulnerability in the GET /admin-api/crm/flow/flow-users endpoint that allows any logged-in back-office user to access approval workflow data. Attackers can retrieve approval chain topology, step ordering, approver identifiers, and personal...

CVE-2026-92461

yshop-crm through 2.1.3 is affected by a missing authorization flaw in the GET /admin-api/crm/flow/flow-users endpoint. Any authenticated back-office user can retrieve approval workflow data, including approval chain topology , step ordering , and approver identifiers , as well as personal inform...

CVE-2026-92461 yshop-crm through 2.1.3 Missing Authorization via CRM Approval-Chain Endpoint

yshop-crm through 2.1.3 contains a missing authorization vulnerability in the GET /admin-api/crm/flow/flow-users endpoint that allows any logged-in back-office user to access approval workflow data. Attackers can retrieve approval chain topology, step ordering, approver identifiers, and personal...

CVE-2026-92462 yshop-crm through 2.1.3 Missing Authorization via CrmFlowController deleteFlowStep

yshop-crm through 2.1.3 fails to enforce authorization checks on the CrmFlowController deleteFlowStep endpoint, allowing any authenticated back-office user to delete arbitrary approval workflow steps. Attackers can invoke the DELETE /admin-api/crm/flow/delete-step endpoint without required...

EUVD-2026-80666

yshop-crm through 2.1.3 contains a missing authorization vulnerability in the GET /admin-api/crm/flow/flow-users endpoint that allows any logged-in back-office user to access approval workflow data. Attackers can retrieve approval chain topology, step ordering, approver identifiers, and personal...

EUVD-2026-80667

yshop-crm through 2.1.3 fails to enforce authorization checks on the CrmFlowController deleteFlowStep endpoint, allowing any authenticated back-office user to delete arbitrary approval workflow steps. Attackers can invoke the DELETE /admin-api/crm/flow/delete-step endpoint without required...

CVE-2026-92460 yshop-crm through 2.1.3 Missing Authorization via CRM Operation-Log Listing

yshop-crm through 2.1.3 fails to enforce authorization on the GET /admin-api/crm/operatelog/page endpoint, allowing any authenticated back-office user to access the installation-wide audit trail. Attackers can query the operation log to retrieve operator names, display nicknames, client IP...

EUVD-2026-80665

yshop-crm through 2.1.3 fails to enforce authorization on the GET /admin-api/crm/operatelog/page endpoint, allowing any authenticated back-office user to access the installation-wide audit trail. Attackers can query the operation log to retrieve operator names, display nicknames, client IP...

CVE-2026-92460

CVE-2026-92460 affects yshop-crm through 2.1.3 , a CRM application. The vulnerability is a missing authorization check on the GET /admin-api/crm/operatelog/page endpoint, allowing any authenticated back-office user to access the installation-wide operation log without proper permission checks. Ex...

CVE-2026-92460 yshop-crm through 2.1.3 Missing Authorization via CRM Operation-Log Listing

yshop-crm through 2.1.3 fails to enforce authorization on the GET /admin-api/crm/operatelog/page endpoint, allowing any authenticated back-office user to access the installation-wide audit trail. Attackers can query the operation log to retrieve operator names, display nicknames, client IP...

CVE-2026-92458

yshop-crm through 2.1.3 contains a missing authorization vulnerability in the StoreProductController onSale handler. The endpoint GET /admin-api/product/store-product/sale lacks proper permission checks, allowing authenticated back-office users to iterate sequential product IDs to withdraw entire...

EUVD-2026-80663

yshop-crm through 2.1.3 contains a missing authorization vulnerability in the StoreProductController onSale handler that allows authenticated back-office users to modify product sale status. Attackers can invoke the GET /admin-api/product/store-product/sale endpoint with sequential product IDs to...

CVE-2026-92458 yshop-crm through 2.1.3 Missing Authorization via StoreProductController onSale

yshop-crm through 2.1.3 contains a missing authorization vulnerability in the StoreProductController onSale handler that allows authenticated back-office users to modify product sale status. Attackers can invoke the GET /admin-api/product/store-product/sale endpoint with sequential product IDs to...

CVE-2026-92458 yshop-crm through 2.1.3 Missing Authorization via StoreProductController onSale

yshop-crm through 2.1.3 contains a missing authorization vulnerability in the StoreProductController onSale handler that allows authenticated back-office users to modify product sale status. Attackers can invoke the GET /admin-api/product/store-product/sale endpoint with sequential product IDs to...

CVE-2026-92459 yshop-crm through 2.1.3 Missing Authorization via CRM Lead-Claim Endpoint

yshop-crm through 2.1.3 contains a missing authorization vulnerability in the CrmCluesController receiveCustomer endpoint that allows authenticated back-office users to claim sales leads without proper permission checks. Attackers can invoke the lead-claim endpoint to reassign leads from other...