CVE-2026-109173

The yshop-crm software (versions through 2.1.3 ) is susceptible to a missing authorization vulnerability. The flaw resides in the CrmInvoiceController check handler, which lacks the @PreAuthorize annotation and has its approver checks commented out. This allows any authenticated back-office user ...