EUVD-2026-80661

yshop-crm through 2.1.3 fails to enforce authorization on the saveRedisSet and getRedisSet endpoints in CrmCustomerController, allowing any authenticated back-office user to read and modify installation-wide lead-allocation and customer auto-recycling policy. Attackers can invoke these endpoints ...

CVE-2026-92456

yshop-crm through 2.1.3 fails to enforce authorization on the saveRedisSet and getRedisSet endpoints in CrmCustomerController , allowing any authenticated back-office user to read and modify installation-wide lead-allocation and customer auto-recycling policy stored in shared Redis keys. An attac...

CVE-2026-92456: Missing Authorization

yshop-crm through 2.1.3 fails to enforce authorization on the saveRedisSet and getRedisSet endpoints in CrmCustomerController, allowing any authenticated back-office user to read and modify installation-wide lead-allocation and customer auto-recycling policy. Attackers can invoke these endpoints ...

PT-2026-93700

Name of the Vulnerable Software and Affected Versions yshop-crm versions prior to 2.1.4 Description Insufficient authorization enforcement on the 'saveRedisSet' and 'getRedisSet' endpoints within the CrmCustomerController allows authenticated back-office users to read and modify installation-wide...