CVE-2026-92459 yshop-crm through 2.1.3 Missing Authorization via CRM Lead-Claim Endpoint

yshop-crm through 2.1.3 contains a missing authorization vulnerability in the CrmCluesController receiveCustomer endpoint that allows authenticated back-office users to claim sales leads without proper permission checks. Attackers can invoke the lead-claim endpoint to reassign leads from other...

CVE-2026-92459

yshop-crm through 2.1.3 is affected by a missing authorization vulnerability in the CrmCluesController receiveCustomer endpoint. Authenticated back-office users can invoke the lead-claim endpoint to reassign sales leads from other employees to themselves by overwriting the ownerUserId field. No a...

CVE-2026-61442

PraisonAI Platform praisonai-platform before 0.1.9 fails to enforce owner/admin authorization on the PATCH routes for projects, issues, and agents, which only require workspace-member role. A workspace member can modify owner-created records; for projects, a member can reassign leadid to their ow...