EUVD-2026-80667

yshop-crm through 2.1.3 fails to enforce authorization checks on the CrmFlowController deleteFlowStep endpoint, allowing any authenticated back-office user to delete arbitrary approval workflow steps. Attackers can invoke the DELETE /admin-api/crm/flow/delete-step endpoint without required...

CVE-2026-92462: Missing Authorization

yshop-crm through 2.1.3 fails to enforce authorization checks on the CrmFlowController deleteFlowStep endpoint, allowing any authenticated back-office user to delete arbitrary approval workflow steps. Attackers can invoke the DELETE /admin-api/crm/flow/delete-step endpoint without required...

PT-2026-93706

Name of the Vulnerable Software and Affected Versions yshop-crm versions prior to 2.1.4 Description Insufficient authorization checks in the CrmFlowController deleteFlowStep function allow any authenticated back-office user to delete arbitrary approval workflow steps. This can be achieved by...