CVE-2026-92459

yshop-crm through 2.1.3 contains a missing authorization vulnerability in the CrmCluesController receiveCustomer endpoint that allows authenticated back-office users to claim sales leads without proper permission checks. Attackers can invoke the lead-claim endpoint to reassign leads from other...

CVE-2026-92459 yshop-crm through 2.1.3 Missing Authorization via CRM Lead-Claim Endpoint

yshop-crm through 2.1.3 contains a missing authorization vulnerability in the CrmCluesController receiveCustomer endpoint that allows authenticated back-office users to claim sales leads without proper permission checks. Attackers can invoke the lead-claim endpoint to reassign leads from other...

CVE-2026-92459

yshop-crm through 2.1.3 is affected by a missing authorization vulnerability in the CrmCluesController receiveCustomer endpoint. Authenticated back-office users can invoke the lead-claim endpoint to reassign sales leads from other employees to themselves by overwriting the ownerUserId field. No a...

CVE-2026-92459: Missing Authorization

yshop-crm through 2.1.3 contains a missing authorization vulnerability in the CrmCluesController receiveCustomer endpoint that allows authenticated back-office users to claim sales leads without proper permission checks. Attackers can invoke the lead-claim endpoint to reassign leads from other...