CVE-2026-92457

yshop-crm through version 2.1.3 contains a missing authorization vulnerability in the CrmInvoiceController issueInvoice endpoint (PUT /admin-api/crm/invoice/issue). Authenticated back-office users can call this endpoint without the required permission check, allowing them to issue arbitrary invoi...