CVE-2026-109172

The yshop-crm software, versions through 2.1.3 , is vulnerable to a missing authorization flaw (CWE-862). The issue exists in the POST /admin-api/crm/contract-receivables/check endpoint, where the handler lacks a @PreAuthorize check. Furthermore, the required approver validation within CrmContrac...

EUVD-2026-97376

yshop-crm through 2.1.3 contains a missing authorization vulnerability that allows any authenticated back-office user to approve or reject receivables records by calling POST /admin-api/crm/contract-receivables/check. The handler lacks a @PreAuthorize check and the approver checks in...